PT-2022-28177

Name of the Vulnerable Software and Affected Versions afire versions prior to 1.1.0 Description This issue affects the built-in serve static extension in afire, allowing paths containing //.... to bypass previous path sanitation and request files in higher directories that should not be accessibl...

Relative Path Traversal vulnerability in StaticDir server

Description There is a relative path traversal vulnerability in the serve module of the extra crate. An attacker can simply request a relative path and access files outside of the configured directory root. Proof of Concept With a static folder in the project directory: rs // main.rs use...

CVE-2022-28380

The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...

CVE-2022-28380

The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...

CVE-2022-28380

The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...

CVE-2022-28380

CVE-2022-28380 affects the rc-httpd component in plan9front (9front fork) up to 2022-03-31. The issue enables directory traversal via a crafted path containing ..%2f when serve-static is used, exposing potential access to restricted files. The connected sources confirm the vulnerable component an...

CVE-2022-28380: Improper Limitation of a Pathname to a Restricted Directory

The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...

PT-2022-18989

Name of the Vulnerable Software and Affected Versions rc-httpd component through 2022-03-31 for 9front Plan 9 fork Description The issue allows ..%2f directory traversal if serve-static is used. Recommendations For the rc-httpd component through 2022-03-31 for 9front Plan 9 fork, consider disabli...

Ice Cream Machine Hackers Sue McDonald's for $900 Million

Kytch alleges that the Golden Arches crushed its business—and left soft serve customers out in the cold...

Directory Traversal

Overview github.com/valyala/fasthttp is a fast HTTP server and client API. Affected versions of this package are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This...

Stack overflow

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL...

The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist

The cold war between a startup and a soft-serve machine manufacturer is heating up, thanks to a newly released trove of internal emails...

Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...

GHSA-4448-RC82-FCR7 Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...

vercel/serve allows access to restricted files if filename is URL encoded.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @pl-test/c (>=1.1.0, <=1.1.1) +5 more potentially affected by CVE-2018-3718 via serve (>=6.0.0, <=6.4.10)

serve NPM version =6.0.0, =0.0.1-prealpha, =1.1.0, =7.1.9, =4.1.8, =5.0.0 Source cves: CVE-2018-3718 Source advisory: OSV:GHSA-5RC4-8QQH-VQ7F...

GHSA-5RC4-8QQH-VQ7F vercel/serve allows access to restricted files if filename is URL encoded.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

Path traversal in rollup-plugin-serve

Overview Path traversal in rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation. Recommendation Upgrade to version 1.0.2 or later References - CVE - GitHub Advisory...

Path traversal in rollup-plugin-serve

Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...

rollup.config.flow (4.0.0), tslib-cli (>=1.0.0, <=5.4.1) potentially affected by CVE-2020-7684 via rollup-plugin-serve (1.0.1)

rollup-plugin-serve NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on rollup-plugin-serve and may be impacted: - rollup.config.flow 4.0.0 - tslib-cli =1.0.0, =5.4.1 Source cves: CVE-2020-7684 Source advisory: OSV:GHSA-4J46-MP85-MV8C...