GHSA-J2WH-WRV3-4X4G Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler

Summary Missing check vulnerability in the static file handler allows any client to access the files in the server's file system Details When staticFiles is set in the serve settings in the configuration file, the following handler doesn't check if absolutePath is still under the directory provid...

PT-2023-36349 · Unknown · @Graphql-Mesh/Http +1

Name of the Vulnerable Software and Affected Versions: @graphql-mesh/cli versions prior to 0.82.21 @graphql-mesh/http versions prior to 0.3.18 Description: A missing check vulnerability in the static file handler allows any client to access files in the server's file system. When staticFiles is s...

SUSE CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...

FlyingPress < 3.9.7 - Arbitrary Settings Update to Stored XSS

The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscribers to call them. One of those actions could allow them to rewrite static files URL JS, CSS etc to a malicious CDN under their control, which could lead to XSS...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...

Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. NeuVector Vulnerability Scanner Plugin 1.20 and earlier globally disables the...

CVE-2022-38668

HTTP applications servers based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB...

Crow 信息泄露漏洞

Crow is a C++ microframework for running Web services. An information disclosure vulnerability exists in Crow 1.0+4 and earlier versions of HTTP applications, which stems from the possibility that the HTTP application server may disclose sensitive data from the stack when processing a request for...

MGASA-2022-0280 Updated ruby-sinatra packages fix security vulnerability

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...

Updated ruby-sinatra packages fix security vulnerability

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...

Fedora: Security Advisory for golang-github-markbates-pkger (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-rakyll-statik-0.1.7-9.fc36

Statik allows you to embed a directory of static files into your Go binary to be later served from an http.FileSystem...

[SECURITY] Fedora 36 Update: golang-github-markbates-pkger-0.17.1-6.fc36

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

[SECURITY] Fedora 35 Update: golang-github-markbates-pkger-0.17.1-5.fc35

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

Fedora: Security Advisory for golang-github-markbates-pkger (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-rakyll-statik-0.1.7-8.fc36

Statik allows you to embed a directory of static files into your Go binary to be later served from an http.FileSystem...

[SECURITY] Fedora 36 Update: golang-github-markbates-pkger-0.17.1-5.fc36

Pkger is a tool for embedding static files into Go binaries. It will, hopeful ly, be a replacement for github.com/gobuffalo/packr/v2...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...

sinatra: path traversal possible outside of public_dir when serving static files

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served...