835 matches found
PT-2019-17673 · Unknown · Serve-Here.Js
Name of the Vulnerable Software and Affected Versions: serve-here.js versions prior to 1.2.0 Description: The issue allows attackers to list any file in an arbitrary folder due to a path traversal vulnerability. This is caused by the package's failure to sanitize URLs, enabling attackers to acces...
GHSA-G8M7-QHV7-9H5X Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...
Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...
Directory Traversal
serve-here.js is vulnerable to directory traversal. The attack is possible as it allows adding ../ to the web root, listing any file in another folder of web root...
Path Traversal
Overview Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later. References - HackerOne Report...
Path Traversal
Overview Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later. References - HackerOne Report -...
Directory Traversal
serve-handler is vulnerable to directory traversal. Attackers are able to access explicitly ignored folders using directory traversal characters ../ followed by the ignored folders. This vulnerability is a bypass of the fix for CVE-2018-3718...
Cross-Site Scripting
Overview Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later. References -...
Path Traversal
Overview Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later. References - HackerOne Report - GitHub...
Node.js third-party modules: [serve-here.js] List any file in the folder by using path traversal.
I would like to report Path Traversal in serve-here.js. It allows to list any file in another folder of web root. Module module name: serve-here.js version: 1.1.3 npm page: https://www.npmjs.com/package/serve-here.js Module Description Serve static files over HTTP Vulnerability Vulnerability...
Information Disclosure
serve-handler is vulnerable to information disclosure attacks. The vulnerability exists as symlinks were enabled by default, and were being resolved during runtime...
Information Exposure
Overview org.webjars.npm:serve-handler is a package responsible for routing requests and handling responses. Affected versions of this package are vulnerable to Information Exposure. The unlisted property removes the file/folder from directory list but still allows viewing them by visiting their...
Directory Traversal
Overview Versions of serve before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. Recommendation Upgrade to version 7.1.3 or later References - HackerOne Report - GitHub Advisory...
chainsql-remixd (1.0.0), fusuma (0.11.4) +1 more potentially affected by CVE-2019-5417 via serve (7.0.0)
serve NPM version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serve and may be impacted: - chainsql-remixd 1.0.0 - fusuma 0.11.4 - remixd =0.1.8-alpha.11, =0.1.8-alpha.16 Source cves: CVE-2019-5417 Source advisory: OSV:GHSA-XG75-3277-GVVJ...
Directory Traversal in serve
Versions of serve before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. Recommendation Upgrade to version 7.1.3 or later...
GHSA-V588-QCP3-JV46 Path Traversal in serve
Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later...
Path Traversal in serve
Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later...
Directory Traversal
serve is vulnerable to directory traversal. The vulnerability exists because it gives an easy interface to list directory contents and traverse into sub-folder just by submitting a URL with dot-slash before the file name, e.g. http://127.0.0.1:6060/dir/./file.txt...
