CVE-2014-125098 Dart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scripting

A vulnerability was found in Dart httpserver up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtualdirectory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross si...

CVE-2014-125098 Dart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scripting

A vulnerability was found in Dart httpserver up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtualdirectory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross si...

CVE-2014-125098

Dart http_server up to 0.9.5 is affected in the VirtualDirectory handler (lib/src/virtual_directory.dart). Malicious manipulation of request.uri.path enables cross-site scripting. The issue can be exploited remotely. Remediation: upgrade to version 0.9.6 (patch: 27c1cbd8125bb0369e675eb72e48218496...

http_server 跨站脚本漏洞

httpserver is an HTTP server utility class. A cross-site scripting vulnerability exists in Dart httpserver 0.9.5 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the request.uri.path parameter...

PT-2023-10166 · Unknown · Dart Http Server

Name of the Vulnerable Software and Affected Versions: Dart http server versions up to 0.9.5 Description: A issue was found in the Directory Listing Handler component, specifically in the VirtualDirectory function of the lib/src/virtual directory.dart file. The manipulation of the request.uri.pat...

Guidance for investigating attacks using CVE-2023-23397

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397. A successful exploit of this vulnerability can result in unauthorized access to an organization’s environment by triggering a Net-NTLMv2 hash leak...

dio vulnerable to CRLF injection with HTTP method string

Impact The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669. Patches The vulnerability has been resolved by https://github.com/cfug/dio/commit/927f79e93ba39f3c3a12c190624a55653d577984, and included sinc...

dio vulnerable to CRLF injection with HTTP method string

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669...

Solving one of NOBELIUM’s most novel attacks: Cyberattack Series

Our story begins with eight Microsoft Detection and Response Team DART analysts gathered around a customer’s conference room to solve a cybersecurity mystery. Joined by members of the customer’s cybersecurity team, they were there to figure out how a Russia-based nation-state hacking group known ...

Solving one of NOBELIUM’s most novel attacks: Cyberattack Series

Our story begins with eight Microsoft Detection and Response Team DART analysts gathered around a customer’s conference room to solve a cybersecurity mystery. Joined by members of the customer’s cybersecurity team, they were there to figure out how a Russia-based nation-state hacking group known ...

Duplicate of GHSA-4xh4-v2pq-jvhm

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4xh4-v2pq-jvhm. This link is maintained to preserve external references. Original Description The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the...

GHSA-9F2C-XXFM-32MJ Duplicate of GHSA-4xh4-v2pq-jvhm

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4xh4-v2pq-jvhm. This link is maintained to preserve external references. Original Description The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the...

CVE-2023-22963

The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^0000-9$ regular expression...

Code injection

The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^0000-9$ regular expression...

Dart 输入验证错误漏洞

Dart is an open source programming language. A security vulnerability exists in versions prior to Dart 3.0.3, which stems from personnummer incorrectly handling the last four digits of a number that matches a ^0000-9$ regular expression...

CVE-2023-22963

CVE-2023-22963 affects the Dart personnummer implementation prior to 3.0.3, which mishandles numbers where the last four digits match the ^000[0-9]$ pattern. The vulnerability arises in the parsing of such numbers and is described across multiple feeds (NVD/Red Hat and regional advisories). The p...

CVE-2023-22963

The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^0000-9$ regular expression...

CVE-2022-3095

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '' characters in URIs, which can lead to auth bypass in webapp...

Design/Logic Flaw

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '' characters in URIs, which can lead to auth bypass in webapp...

PT-2022-20404 · Google · Flutter +1

Name of the Vulnerable Software and Affected Versions: Dart versions prior to 2.18 Flutter versions prior to 3.30 Description: The implementation of backslash parsing in the Dart URI class differs from the WhatWG URL standards, as it uses the RFC 3986 syntax. This creates incompatibilities with t...