714 matches found
Django DoS in django.views.static.serve
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...
Relative Path Traversal vulnerability in StaticDir server
Description There is a relative path traversal vulnerability in the serve module of the extra crate. An attacker can simply request a relative path and access files outside of the configured directory root. Proof of Concept With a static folder in the project directory: rs // main.rs use...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
CVE-2022-28380 affects the rc-httpd component in plan9front (9front fork) up to 2022-03-31. The issue enables directory traversal via a crafted path containing ..%2f when serve-static is used, exposing potential access to restricted files. The connected sources confirm the vulnerable component an...
Ice Cream Machine Hackers Sue McDonald's for $900 Million
Kytch alleges that the Golden Arches crushed its business—and left soft serve customers out in the cold...
Directory Traversal
Overview github.com/valyala/fasthttp is a fast HTTP server and client API. Affected versions of this package are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This...
Stack overflow
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL...
The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist
The cold war between a startup and a soft-serve machine manufacturer is heating up, thanks to a newly released trove of internal emails...
Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...
GHSA-4448-RC82-FCR7 Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...
vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...
GHSA-5RC4-8QQH-VQ7F vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...
Path traversal in rollup-plugin-serve
Overview Path traversal in rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation. Recommendation Upgrade to version 1.0.2 or later References - CVE - GitHub Advisory...
@appnest/web-config (>=0.1.0 <=0.1.35), @auth0/oidc-implicit-flow (>=0.0.1-alpha.1 <=0.0.1-alpha.4) +33 more potentially affected by CVE-2020-7684 via rollup-plugin-serve (>=0.1.0 <=1.0.1)
rollup-plugin-serve NPM version =0.1.0, =0.1.0, =0.0.1-alpha.1, =2.0.0, =1.0.2, =1.2.6, =0.0.1136, =0.2.0, =1.0.0-alpha.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =1.0.4 and more Source cves: CVE-2020-7684 Source advisory: OSV:GHSA-4J46-MP85-MV8C...
Path traversal in rollup-plugin-serve
Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...
GHSA-4J46-MP85-MV8C Path traversal in rollup-plugin-serve
Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...
PT-2021-12084 · Unknown · Golang-Nanoauth
Name of the Vulnerable Software and Affected Versions: golang-nanoauth versions v0.0.0-20160722212129-ac0cc4484ad4 through v0.0.0-20200131131040-063a3fb69896 Description: The issue concerns a global bypass of authentication in the golang-nanoauth library. When the ListenAndServe function is calle...