rollup.config.flow (4.0.0), tslib-cli (>=1.0.0, <=5.4.1) potentially affected by CVE-2020-7684 via rollup-plugin-serve (1.0.1)

rollup-plugin-serve NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on rollup-plugin-serve and may be impacted: - rollup.config.flow 4.0.0 - tslib-cli =1.0.0, =5.4.1 Source cves: CVE-2020-7684 Source advisory: OSV:GHSA-4J46-MP85-MV8C...

PT-2021-12084 · Unknown · Golang-Nanoauth

Name of the Vulnerable Software and Affected Versions: golang-nanoauth versions v0.0.0-20160722212129-ac0cc4484ad4 through v0.0.0-20200131131040-063a3fb69896 Description: The issue concerns a global bypass of authentication in the golang-nanoauth library. When the ListenAndServe function is calle...

GHSA-9VHV-P9R7-RM53 HTML tag injection

Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page...

HTML tag injection

Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page...

PT-2021-24409

Name of the Vulnerable Software and Affected Versions: Serve Handler versions prior to 5.0.3 Description: The issue is related to a XSS via HTML tag injection in the directory listing page. Recommendations: For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue...

PT-2021-30927

Уязвимость программного обеспечения для создания частной виртуальной сети astra-openvpn-serve связана с некорректным созданием сертификатов, который создается без параметров аутентификации. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, получить доступ к конфиденциальным...

Cesanta Mongoose 缓冲区错误漏洞

Mongoose is a C/C++ network library. An out-of-bounds write vulnerability exists in the mghttpservefile function in Cesanta Mongoose 7.0. An attacker can exploit this vulnerability via a connection request to cause an out-of-bounds write after the memory pool is exhausted...

PT-2021-17023

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose HTTP server version 7.0 Description The issue concerns a remote out-of-bounds OOB write attack via a connection request after exhausting the memory pool. This is specifically related to the mg http serve file function...

Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 10.0.2 or later...

@ieremeev/app (>=3.0.1, <=3.2.4), xtal-test (>=0.0.1, <=0.0.10) potentially affected by unknown CVE via serve (10.0.0)

serve NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serve and may be impacted: - @ieremeev/app =3.0.1, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-CPGR-WMR9-QXV4...

GHSA-CPGR-WMR9-QXV4 Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 10.0.2 or later...

Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later...

@ieremeev/app (>=3.0.1, <=3.2.4), xtal-test (>=0.0.1, <=0.0.10) potentially affected by unknown CVE via serve (10.0.0)

serve NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serve and may be impacted: - @ieremeev/app =3.0.1, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-XW79-HHV6-578C...

GHSA-XW79-HHV6-578C Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later...

Path Traversal in serve

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later...

GHSA-48GC-5J93-5CFQ Path Traversal in serve

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later...

@ieremeev/app (>=3.0.1, <=4.1.1), @meetup/swarm-docs (0.7.10-beta.0) +7 more potentially affected by unknown CVE via serve (>=10.0.0, <=10.1.1)

serve NPM version =10.0.0, =3.0.1, =0.1.0, =0.0.12, =0.0.0, =0.0.10, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-48GC-5J93-5CFQ...

PT-2020-21006

Name of the Vulnerable Software and Affected Versions serve versions prior to 10.1.2 Description The issue allows attackers to access hidden folders and files through relative paths, despite explicitly ignored folders. This is due to a path traversal problem. Recommendations Upgrade to version...

PT-2020-21598

Name of the Vulnerable Software and Affected Versions serve versions prior to 10.0.2 Description The issue allows attackers to execute arbitrary JavaScript in the victim's browser due to the package not encoding output when user-supplied input is rendered. This can lead to Cross-Site Scripting XS...

PT-2020-21243

Name of the Vulnerable Software and Affected Versions serve versions prior to 10.0.2 Description The issue arises from the package's failure to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This c...