534 matches found
PT-2021-12080 · Unknown · Static File Handler
Name of the Vulnerable Software and Affected Versions: Static File Handler affected versions not specified Description: The issue arises from improper sanitization of user input on Windows, allowing the static file handler to permit directory traversal. This enables an attacker to read files...
CVE-2021-21291
CVE-2021-21291: OAuth2 Proxy (open-source reverse proxy) before v7.0.0 had a vulnerability in the whitelist-domain feature where a domain matched for redirects could be broader than intended (e.g., .example.com could match example.com and badexample.com). This could allow unintended redirects. Im...
GHSA-44G9-W23C-5RW7 Directory Traversal in nhouston
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory. Recommendation It is recommended that a different module be used, as we have been unable to reacher the maintainer...
Directory Traversal in nhouston
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory. Recommendation It is recommended that a different module be used, as we have been unable to reacher the maintainer...
Directory Traversal
Overview rollup-plugin-server is a rollup plugin to serve the bundle. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function. PoC by JHU System Security Lab 1. Create a serv...
jetty: full server path revealed when using the default Error Handling
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...
ecstatic denial of service vulnerability
ecstatic is a simple static file server middleware. A denial of service vulnerability exists in ecstatic. An attacker could exploit this vulnerability to cause the application to crash...
Denial of Service (DoS)
Overview ecstatic is a simple static file server middleware. Use it with a raw http server, express/connect or on the CLI. Affected versions of this package are vulnerable to Denial of Service DoS. It is possible to crash a server using the package due to the way URL params parsing is handled...
GHSA-85RF-XH54-WHP3 Malicious URL drafting attack against iodines static file server may allow path traversal
Impact A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version. Malicious URL drafting may cause the static file server to attempt a response containing data from file...
Malicious URL drafting attack against iodines static file server may allow path traversal
Impact A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version. Malicious URL drafting may cause the static file server to attempt a response containing data from file...
PT-2019-19979
Name of the Vulnerable Software and Affected Versions Iodine versions less than 0.7.33 Description A path traversal issue in the static file service allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. This can be achieved by drafting malicious UR...
Malicious URL drafting attack against iodines static file server may allow path traversal
Impact A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version. Malicious URL drafting may cause the static file server to attempt a response containing data from file...
Serve-here.js path traversal vulnerability
serve-here.js is an HTTP static file server. A path traversal vulnerability in serve-here.js v1.1.3 and prior versions, which arises from a failure of a networked system or product to properly filter for special elements in the path of a resource or file, can be exploited by an attacker to access...
GHSA-886V-MM6P-4M66 High severity vulnerability that affects gun
Urgent Upgrade The static file server module included with GUN had a serious vulnerability: - Using curl --path-as-is allowed reads on any parent directory or files. This did not work via the browser or via curl without as-is option. Fixed This has been fixed since version 0.2019.416 and higher...
High severity vulnerability that affects gun
Urgent Upgrade The static file server module included with GUN had a serious vulnerability: - Using curl --path-as-is allowed reads on any parent directory or files. This did not work via the browser or via curl without as-is option. Fixed This has been fixed since version 0.2019.416 and higher...
PT-2019-20025
Name of the Vulnerable Software and Affected Versions GUN versions prior to 0.2019.416 Description A serious issue was found in the static file server module included with GUN, where using curl --path-as-is allowed reads on any parent directory or files. This issue did not affect requests made vi...
Node.js third-party modules: [public] Path traversal using symlink
I would like to report Path traversal vulnerability in public module Module module name: public version: 0.1.4 npm page: https://www.npmjs.com/package/public Module Description Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. Module...
Node.js third-party modules: [statichttpserver] List any file in the folder by using path traversal.
I would like to report Path Traversal in statichttpserver. It allows to list any file in another folder of web root. Module module name: statichttpserver version: 0.9.7 npm page: https://www.npmjs.com/package/statichttpserver Module Description 'statichttpserver' is inspired by SimpleHTTPServer.p...
buttle npm package cross-site scripting vulnerability
buttle npm package is a static file server. A cross-site scripting vulnerability exists in version 0.2.0 of the buttle npm package, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
