CVE-2022-27140: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload...

express-fileupload 代码问题漏洞

express-fileupload is a file upload middleware by Richard Girges, an individual developer in the United States. A security vulnerability exists in express-fileupload v1.3.1, which allows an attacker to upload multiple files with the same name, resulting in the overwriting of files in the web...

PT-2022-18246 · Unknown · Express-Fileupload

Name of the Vulnerable Software and Affected Versions: express-fileupload version 1.3.1 Description: An arbitrary file upload vulnerability in the file upload module of express-fileupload allows attackers to execute arbitrary code via a crafted PHP file. The vendor's position is that the observed...

@aoboxinda/budget (>=0.1.155, <=0.1.186), @coobo/skeleton (>=1.0.0-a, <=1.0.0) +5 more potentially affected by unknown CVE via express-fileupload (>=1.0.0, <=1.1.5)

express-fileupload NPM version =1.0.0, =0.1.155, =1.0.0-a, =0.0.1-alpha.151, =0.0.1-alpha.44, =1.1.0, =1.0.0, =1.0.9 Source cves: unknown CVE Source advisory: OSV:GHSA-Q3W9-G74Q-VP5F...

GHSA-Q3W9-G74Q-VP5F Denial of Service in express-fileupload

Versions of express-fileupload prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed up to 30s in internal testing if the request contains a large filename of . characters. Recommendation Upgrade to version 1.1.6-alpha.6 or later...

Denial of Service in express-fileupload

Versions of express-fileupload prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed up to 30s in internal testing if the request contains a large filename of . characters. Recommendation Upgrade to version 1.1.6-alpha.6 or later...

GHSA-9WCG-JRWF-8GG7 Prototype Pollution in express-fileupload

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

Prototype Pollution in express-fileupload

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

@aoboxinda/budget (>=0.1.155, <=0.1.186), @coobo/skeleton (>=1.0.0-a, <=1.0.0) +8 more potentially affected by CVE-2020-7699 via express-fileupload (>=1.0.0, <=1.1.6-alpha.5)

express-fileupload NPM version =1.0.0, =0.1.155, =1.0.0-a, =0.0.1-alpha.151, =0.0.1-alpha.44, =1.1.0, =1.0.0, =1.1.4, =2.2.7-7, =2.2.10 Source cves: CVE-2020-7699 Source advisory: OSV:GHSA-9WCG-JRWF-8GG7...

Prototype Pollution

express-fileupload is vulnerable to prototype pollution. The vulnerability exists as it does not restrict the proto, constructor keys in lib/processNested.js...

CVE-2020-7699

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

CVE-2020-7699

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

CVE-2020-7699 Prototype Pollution

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

CVE-2020-7699

CVE-2020-7699 affects the Node.js Express Fileupload package: versions prior to 1.1.8 are vulnerable when the parseNested option is enabled. The root cause is a prototype pollution issue that can enable denial of service or arbitrary code execution via specially crafted HTTP requests. A fix is av...

PT-2020-19722

Name of the Vulnerable Software and Affected Versions express-fileupload versions prior to 1.1.8 Description The issue allows for denial of service or arbitrary code execution when a corrupt HTTP request is sent and the parseNested option is enabled. Recommendations For express-fileupload version...

CVE-2020-7699: Improperly Controlled Modification of Object Prototype Attributes

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

Prototype Pollution

Overview express-fileupload is a file upload middleware for express that wraps around busboy. Affected versions of this package are vulnerable to Prototype Pollution. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

@aoboxinda/budget (>=0.1.155, <=0.1.186), @coobo/skeleton (>=1.0.0-a, <=1.0.0) +10 more potentially affected by CVE-2020-7699 via express-fileupload (>=1.0.0, <=1.1.9)

express-fileupload NPM version =1.0.0, =0.1.155, =1.0.0-a, =0.0.1-alpha.151, =0.0.1-alpha.44, =1.1.0, =1.0.0, =1.1.4, =0.0.21, =2.2.7-7, =2.2.10 Source cves: CVE-2020-7699 Source advisory: SNYK:JS-EXPRESSFILEUPLOAD-595969...

Denial of Service

Overview Versions of express-fileupload prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed up to 30s in internal testing if the request contains a large filename of . characters. Recommendation Upgrade to version 1.1.6-alpha.6 or later...