apeman-app-mqtt (>=1.0.0, <=2.0.1), apeman-proto-mqtt (>=1.0.0, <=2.0.0) +20 more potentially affected by CVE-2017-16224 via st (1.1.0)

st NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on st and may be impacted: - apeman-app-mqtt =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.0, =0.0.1, =1.0.0-pre1, =1.0.2, =0.0.8, =0.2.1 - mqtter 0.3.1 and more Source cves: CVE-2017-16224 Sourc...

CVE-2017-16224

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

CVE-2017-16224

The CVE-2017-16224 entry concerns the Node.js module st, which serves static files. A crafted request can trigger an HTTP 301 redirect to an entirely different domain. This requires st to be serving from the server root (/) rather than a subdirectory (e.g., /static/). The redirect URL ends with U...

CVE-2017-16224

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...