GHSA-H4HV-M4H4-MHWG Django open redirect

A maliciously crafted URL to a Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 site using the django.views.static.serve view could redirect to any other domain, aka an open redirect vulnerability...

Node.js third-party modules: [serve] XSS via HTML tag injection in directory lisiting page

I would like to report HTML injection in serve module. It allows malicious HTML tags injection and execution of arbitrary JS code Module module name: serve version: 9.6.0 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

Directory Traversal in serve

Affected versions of serve do not properly handle %2e . and %2f / characters, and allow the, characters to be used in paths. This can be used to traverse the directory tree and list content of any directory the user running the process has access to. Mitigating factors: This vulnerability only...

GHSA-Q2QH-CGC2-QHR3 Directory Traversal in serve

Affected versions of serve do not properly handle %2e . and %2f / characters, and allow the, characters to be used in paths. This can be used to traverse the directory tree and list content of any directory the user running the process has access to. Mitigating factors: This vulnerability only...

Information Exposure on Case Insensitive File Systems in serve

Versions of serve before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems. Recommendation Update to version 7.0.0 or later...

Directory Traversal

serve-handler is vulnerable to directory traversal vulnerability. This attack is possible by requesting a URL such as ../../../../../etc/passwd to obtain confidential information...

Serve Path Traversal Vulnerability

serve is a static file server that is primarily used for deploying native single-page applications or static files. A path traversal vulnerability exists in serve versions prior to 6.4.9, where the program fails to adequately filter %2e . and %2f / characters in the url. and %2f / characters in t...

Serve Information Disclosure Vulnerability

serve is an HTTP server for deploying single page applications. A security vulnerability exists in serve, which stems from the program not handling URL encoding correctly. The vulnerability can be exploited to disclose information via directory listings...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

Path traversal

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...

CVE-2018-3712

CVE-2018-3712 affects the Node.js package named “serve” and its static file serving behavior. Versions prior to 6.4.9 fail to properly filter the characters %2e (.) and %2f (/), allowing them in paths and enabling a path-traversal that can list directory contents. The core impact described across...

PT-2018-16142 · Node.Js · Serve

Name of the Vulnerable Software and Affected Versions: serve node module affected versions not specified Description: The issue is related to improper handling of URL encoding, allowing access to ignored files if a filename is URL encoded. This can potentially lead to unauthorized access to...

CVE-2018-3809

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

CVE-2018-3809

The CVE-2018-3809 entry refers to the Node.js module serve (v6.5.3) exposing information via directory listings and bypassing ignore rules on case-insensitive file systems. Technical details from connected records show that versions before 7.0.0 are affected and allow reading ignored files or lis...

CVE-2018-3809

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

Directory Traversal

serve is vulnerable to directory traversal attacks. The vulnerability exists due to the improper user input sanitization where having a ./ dot slash, or the use of uppercase characters for serve hosted in Mac OS, in the input can cause directory traversal attacks...

Node.js third-party modules: [serve] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in serve. It allows reading local files on the target server. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

Node.js third-party modules: [serve] Stored XSS in the filename when directories listing

I would like to report a Stored XSS issue in module serve It allows executing malicious javascript code in the user's browser. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

ISC BIND Multiple Denial of Service Vulnerabilities (May 2018)

ISC BIND is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:isc:bind";...

FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)

ISC reports : An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can le...