PT-2019-17667

Name of the Vulnerable Software and Affected Versions harp versions = 0.29.0 Description The issue allows information exposure through directory listing, enabling access to files that should be ignored according to the server rules. This is due to the harp module not properly handling URL-encoded...

PT-2019-17668

Name of the Vulnerable Software and Affected Versions harp versions = 0.29.0 Description The issue allows for path traversal using a symlink, potentially leading to unauthorized file access. If a symlink in the project's base directory points to a file outside of the directory, the file is served...

CVE-2019-5437: Exposure of Information Through Directory Listing

Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are = 0.29.0 and no fix was applied to our knowledge...

CVE-2019-5438: Improper Limitation of a Pathname to a Restricted Directory

Path traversal using symlink in npm harp module versions = 0.29.0...

Unauthorized File Access

Overview Affected versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation Upgrade to version 0.40.3...

Unauthorized File Access

Overview Affected versions of harp are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as secret-folder. If the underscore character is URL encoded the server delivers the file. Recommendation Upgrade ...

@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5437 via harp (>=0.9.5, <=0.32.0)

harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5437 Source advisory: SNYK:JS-HARP-174149...

Information Exposure

Overview harp is a zero-configuration web server with built in pre-processing. Affected versions of this package are vulnerable to Information Exposure. The documentation explicitly mentions that files or directories with names that start with an underscore are ignored by the server and are not...

Directory Traversal

harp is vulnerable to directory traversal. The attack exists due to the ignorance of the harp server rules for the file path starting with underscore, allowing an unauthorized listing of the files in another folder of web root...

Cross-Site Scripting

Overview All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, harp does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files. Recommendation No fix is currently available. Consider usin...

Cross-Site Scripting (XSS)

harp is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser due to unsafe rendering of markdown files...

Information Disclosure

harp is vulnerable to information disclosure. A remote attacker is able to retrieve files within the web root that are marked as ignored using a URL encoded underscore character %5f, e.g %5fsecret.txt...

Node.js third-party modules: [harp] Path traversal using symlink

In reference to 453820 Module module name: harp version: 0.29.0 npm page: https://www.npmjs.com/package/harp Module Description zero-configuration web server with built in pre-processing Module Stats 2,679 downloads in the last week Vulnerability Path traversal using symlink. Vulnerability...

Node.js third-party modules: [harp] File access even when they have been set to be ignored.

I would like to report information disclosure through file access in harp. It allows to access files that are supposed to be ignored according to the harp server rules. Module module name: harp version: 0.29.0 npm page: https://www.npmjs.com/package/harp Module Description zero-configuration web...

Node.js third-party modules: [harp] Unsafe rendering of Markdown files

I would like to report Cross Site Scripting vulnerablity in harp module It allows to execute arbitrary JavaScript due to unsafe rendering of markdown files. Similar to 404126 Module module name: harp version: 0.29.0 npm page: https://www.npmjs.com/package/harp Module Description zero-configuratio...

To“hypnosis”to bypass authentication: an influence of the Kerberos Protocol for up to 20 years of vulnerabilities-vulnerability warning-the black bar safety net

! Kerberos this is a noun derived from the Greek mythology“the three heads of the dog--Hades the Keeper of the dog,”in the system is an authentication Protocol that uses tickets to allow nodes in an insecure network environment to communicate securely, it is possible to prevent eavesdropping, to...

Harp Sound Effect Plug-in - Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Harp Sound Effect Plug-in published at the 'play' market has multiple vulnerabilities...