Directory Traversal

buttle is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization of filename, allowing directory traversal attacks...

Path traversal

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

CVE-2018-3766

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

CVE-2018-3766

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

CVE-2018-3766

The CVE-2018-3766 issue affects the buttle module for Node.js, where versions

CVE-2018-3766

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

PT-2018-16184 · Buttle · Buttle

Name of the Vulnerable Software and Affected Versions: buttle versions = 0.2.0 Description: The issue concerns a path traversal vulnerability in the buttle module, allowing attackers to read any file on the server due to insufficient input sanitization. This can be exploited by using relative pat...

CVE-2018-3766: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in buttle module versions = 0.2.0 allows to read any file in the server...

Node.js third-party modules: [buttle] Path traversal in mid-buttle module allows to read any file in the server.

Hello Node.js third-party modules I would like to report path traversal in buttle module It allows me to read any file in the server if i know the path. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Description Simple static file + markdown server...

Command Injection

Overview All versions of buttle are vulnerable to command injection. Remote command execution is possible when buttle is run with the --php-bin flag. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time...

Node.js third-party modules: [buttle] HTML Injection in filename leads to XSS when directory listing is displayed in the browser

I would like to report HTML Injection in buttle module. Due to lack of filenames sanitization, it is possible to inject malicious iframe tag via filename and execute arbitray JavaScript code. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Descripti...