425 matches found
PT-2021-23030 · Mkdocs +1 · Mkdocs +1
Name of the Vulnerable Software and Affected Versions: mkdocs version 1.2.2 Description: The mkdocs built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Recommendations: For mkdocs version 1.2.2, as a temporary workaroun...
Older releases of better_errors open to Cross-Site Request Forgery attack
Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...
GHSA-W3J4-76QW-WWJM Older releases of better_errors open to Cross-Site Request Forgery attack
Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +15404 more potentially affected by CVE-2021-24033 via react-dev-utils (>=0.4.0, <=11.0.3)
react-dev-utils NPM version =0.4.0, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =1.0.3, =1.0.11 and more Source cves: CVE-2021-24033 Source advisory: OSV:GHSA-5Q6M-3H65-W53X...
GHSA-VR98-27QJ-3C8Q Directory traversal in rollup-plugin-server
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
Directory traversal in rollup-plugin-server
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
rollup-plugin-dev-server path traversal vulnerability
rollup-plugin-dev-server is a plugin summary package. A path traversal vulnerability exists in the readFile operation of the 'readFileFromContentBase' function in rollup-plugin-dev-server all versions, which stems from the program's failure to clean up paths, and can be exploited by an attacker t...
CVE-2020-7686
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
Path traversal
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
CVE-2020-7686
CVE-2020-7686 affects all versions of rollup-plugin-dev-server. The issue is a directory traversal vulnerability caused by lack of path sanitization in the readFile operation within the readFileFromContentBase function, enabling potential access to arbitrary files. Multiple sources (NVD, CVE list...
CVE-2020-7686 Directory Traversal
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
CVE-2020-7686
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function...
@enact/cli (>=0.9.6, <=0.9.8), abt.api.web (0.0.3) +28 more potentially affected by CVE-2018-6342 via react-dev-utils (>=3.0.0, <=3.1.1)
react-dev-utils NPM version =3.0.0, =0.9.6, =4.2.0, =1.5.1, =0.15.0, =0.7.0, =0.7.0, =0.1.0, =0.1.4, =1.9.2, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...
@5minutes2start/react-scripts (>=1.1.2, <=1.1.4), @biko/react-scripts (>=0.1.0, <=0.4.0) +132 more potentially affected by CVE-2018-6342 via react-dev-utils (>=4.0.0, <=4.2.1)
react-dev-utils NPM version =4.0.0, =1.1.2, =0.1.0, =0.8.12, =0.1.0, =0.0.1, =2.13.0, =2.14.0, =0.2.0, =0.3.0, =0.2.2, =0.2.10-SNAPSHOT.481, =0.2.10-SNAPSHOT.673 - @leizeng/react-scripts-ts 2.13.0 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...
GHSA-CF66-XWFP-GVC4 Missing Origin Validation in webpack-dev-server
Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...
2muchcoffee-react-scripts (0.1.0), 2muchcoffee-react-scripts2 (>=0.1.0, <=0.1.2) +993 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=3.0.0, <=3.1.10)
webpack-dev-server NPM version =3.0.0, =0.1.0, =0.6.2, =2.1.1, =0.1.0, =1.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =2.1.2-4, =2.2.0-beta.1, =1.0.0, =0.8.8, =0.12.0 and more Source cves: CVE-2018-14732 Source advisory: OSV:GHSA-CF66-XWFP-GVC4...
Missing Origin Validation in webpack-dev-server
Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...
Missing Origin Validation
Overview Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not...
Code Sniffing
webpack-dev-server is vulnerable to Code Sniffing. The code sniffing is possible because WebSocket server for HMR Hot Module Replacement does not validate the origin of the request, allowing unauthorised users to access HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connectio...
CVE-2018-14732
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...