WS-2019-0167

buttle all versions have Cross-Site Scripting vulnerability Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files...

WS-2018-0095

All versions of buttle are vulnerable to command injection. Remote command execution is possible when buttle is run with the --php-bin flag...

EUVD-2018-0460

Malware in sbrugna...

EUVD-2019-0421

Malware in sbrugna...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

GHSA-PQPP-2363-649V Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

PT-2020-21444

Name of the Vulnerable Software and Affected Versions buttle versions all Description The issue is related to Cross-Site Scripting due to a misconfiguration of the rendering engine in buttle, which fails to sanitize HTML output. This allows attackers to execute arbitrary JavaScript when processin...

Cross-Site Scripting

Overview All versions of buttle are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Conside...

Path Traversal

Overview All versions of buttle are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

Cross-Site Scripting

Overview All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

GHSA-GM29-35C7-8CFW Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

buttle npm package cross-site scripting vulnerability

buttle npm package is a static file server. A cross-site scripting vulnerability exists in version 0.2.0 of the buttle npm package, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2019-5422

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

CVE-2019-5422

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

Cross site scripting

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

CVE-2019-5422

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

CVE-2019-5422

The buttle npm package (version 0.2.0) is vulnerable to Cross-Site Scripting (XSS) due to lack of filename sanitization, enabling attacker-controlled JavaScript in the victim’s browser when files with malicious names are processed by the server. Multiple sources (npm advisory, GitHub/GHSA, CNVD, ...

CVE-2019-5422

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

PT-2019-17655

Name of the Vulnerable Software and Affected Versions buttle version 0.2.0 buttle versions prior to a fixed version no fixed version specified Description The issue allows execution of attacker-provided code in the victim's browser. This occurs when an attacker creates an arbitrary file on the...