GHSA-GMXV-XF2Q-6J8M Cross-Site Scripting in m-server

Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving. Recommendation Update to version 1.4.2 or later...

CVE-2019-7585: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI...

M-Server Path Traversal Vulnerability

m-server is a small http static server . M-Server suffers from a path traversal vulnerability that arises from a failure of a network system or product to properly filter special elements in the path of a resource or file. An attacker could use this vulnerability to access locations outside of a...

M-Server Cross-Site Scripting Vulnerability

M-Server is a small http static server . M-Server suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Security Bulletin: IBM OpenPages GRC Platform is affected by a vulnerability in Apache Commons FileUpload (CVE-2016-1000031)

Summary IBM OpenPages GRC Platform has addressed vulnerability in Apache Commons FileUpload CVE-2016-1000031 Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrar...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

Cross site scripting

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

Path traversal

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16484

The CVE-2018-16484 entry concerns m-server prior to 1.4.2, where filenames displayed in directory listings are not escaped, allowing stored XSS via crafted filenames to execute malicious JavaScript/HTML. Affected component: m-server (module used for static HTTP serving); root cause: lack of escap...

CVE-2018-16485

CVE-2018-16485 describes a directory traversal vulnerability in the m-server Node.js module prior to version 1.4.1. The flaw arises because the server constructs targetPath with req.url using path.join and then serves the file without sanitizing the path, enabling an attacker to read arbitrary fi...

PT-2019-9309

Name of the Vulnerable Software and Affected Versions m-server versions prior to 1.4.1 Description A Path Traversal issue exists, allowing a malicious user to access unauthorized content of any file in the directory tree, for example, /etc/passwd, by appending slashes to the URL request...

CVE-2018-16484: Improper Neutralization of Input During Web Page Generation

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16485: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...