5923 matches found
CVE-2023-49329
creationtimestamp| type| source ---|---|--- 2024-01-19 22:22:02+00:00| seen| https://t.me/ctinow/170434 2024-02-15 15:56:48+00:00| seen| https://t.me/ctinow/185641 2025-06-20 18:42:30+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19035...
GHSA-C24V-8RFC-W8VW Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...
CVE-2024-23331
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
CVE-2024-23331
CVE-2024-23331 (Vite) : The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems by using case-augmented filenames. The issue occurs because picomatch defaults to case-sensitive glob matching, while the file server does not, enabling a blacklist bypass and potent...
CVE-2024-23331
Vite is a frontend tooling framework for javascript. The Vite dev server option "server.fs.deny" can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface ar...
CVE-2024-22877
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...
Cross site scripting
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...
PT-2024-19594 · Strangebee · Thehive
Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 5.1.0 through 5.1.9 StrangeBee TheHive versions 5.2.0 through 5.2.8 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the case attachment functionality. This allows an attacker to upload a...
CVE-2024-22877: Improper Neutralization of Input During Web Page Generation
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...
PT-2024-19595
Name of the Vulnerable Software and Affected Versions StrangeBee TheHive versions 5.2.0 through 5.2.8 Description The case reporting functionality in StrangeBee TheHive is susceptible to Cross Site Scripting XSS, allowing an attacker to insert malicious JavaScript code inside the template or its...
CVE-2024-22876: Improper Neutralization of Input During Web Page Generation
StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL...
CVE-2024-23331: Improper Handling of Case Sensitivity
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
PT-2024-19813
Name of the Vulnerable Software and Affected Versions Vite versions prior to 2.9.17 Vite versions prior to 3.2.8 Vite versions prior to 4.5.2 Vite versions prior to 5.0.12 Description The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented...
Vite Security Vulnerabilities
Vite is a new front-end build tool from Vite open source. Vite has a security vulnerability , the vulnerability stems from the file system is not case-sensitive...
CVE-2023-47459
An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagement.svc/GetProductSiteName component...
Knovos Discovery Security Vulnerability
Knovos Discovery is a comprehensive legal discovery platform from Knovos, Inc. A security vulnerability exists in Knovos Discovery version v.22.67.0, which originated from a vulnerability that allows remote attackers to obtain sensitive information via the...
CVE-2024-20709 New Edge T5 MSRC Case [DCMSFT-1081]
Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...