77 matches found
@here/harp-leaflet (>=0.2.4, <=0.2.5) potentially affected by CVE-2020-8244 via bl (4.0.2)
bl NPM version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @here/harp-leaflet =0.2.4, =0.2.5 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...
PT-2020-21256
Name of the Vulnerable Software and Affected Versions harp versions all Description The issue concerns a Cross-Site Scripting vulnerability due to the misconfiguration of the rendering engine in harp, which fails to sanitize HTML output. This allows attackers to run arbitrary JavaScript when...
PT-2020-21202
Name of the Vulnerable Software and Affected Versions harp versions affected versions not specified Description The issue allows for Cross-Site Scripting, where an attacker can inject arbitrary JavaScript as a new product option in the admin page, enabling the execution of arbitrary code. This...
@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5438 via harp (>=0.9.5, <=0.32.0)
harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5438 Source advisory: OSV:GHSA-6FMM-47QC-P4M4...
GHSA-6FMM-47QC-P4M4 Unauthorized File Access in harp
All versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation No fix is currently available. Consider...
Unauthorized File Access in harp
All versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation No fix is currently available. Consider...
@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5437 via harp (>=0.9.5, <=0.32.0)
harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5437 Source advisory: OSV:GHSA-46HV-7769-J7RX...
GHSA-46HV-7769-J7RX Unauthorized File Access in harp
Affected versions of harp are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as secret-folder. If the underscore character is URL encoded the server delivers the file. Recommendation Upgrade to versio...
Unauthorized File Access in harp
Affected versions of harp are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as secret-folder. If the underscore character is URL encoded the server delivers the file. Recommendation Upgrade to versio...
CVE-2019-5437
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are = 0.29.0 and no fix was applied to our knowledge...
Information disclosure
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are = 0.29.0 and no fix was applied to our knowledge...
Path traversal
Path traversal using symlink in npm harp module versions = 0.29.0...
CVE-2019-5438
Path traversal using symlink in npm harp module versions = 0.29.0...
CVE-2019-5437
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are = 0.29.0 and no fix was applied to our knowledge...
CVE-2019-5438
Path traversal using symlink in npm harp module versions = 0.29.0...
CVE-2019-5437
Summary: The CVE concerns the npm module harp (Node.js web server). Affected versions are
CVE-2019-5437
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are = 0.29.0 and no fix was applied to our knowledge...
CVE-2019-5438
Summary: The CVE-2019-5438 issue affects the npm package harp, specifically versions ≤ 0.29.0, where an attacker can exploit a symlink-based path traversal to access files outside the project directory. This vulnerability allows serving sensitive files via the harp server when a symlink points to...
