CVE-2018-3712

CVE-2018-3712 affects the Node.js package named “serve” and its static file serving behavior. Versions prior to 6.4.9 fail to properly filter the characters %2e (.) and %2f (/), allowing them in paths and enabling a path-traversal that can list directory contents. The core impact described across...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @jimpick/lambda-comments-frontend (>=0.0.1, <=0.0.3) +56 more potentially affected by CVE-2018-3718 via serve (>=1.2.0, <=6.4.10)

serve NPM version =1.2.0, =0.0.1-prealpha, =0.0.1, =0.0.2, =1.1.0, =1.0.0, =0.0.0-alpha, =1.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2018-3718 Source advisory: MEND:CVE-2018-3718...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @jimpick/lambda-comments-frontend (>=0.0.1, <=0.0.3) +56 more potentially affected by CVE-2018-3712 via serve (>=1.2.0, <=6.4.4)

serve NPM version =1.2.0, =0.0.1-prealpha, =0.0.1, =0.0.2, =1.1.0, =1.0.0, =0.0.0-alpha, =1.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2018-3712 Source advisory: MEND:CVE-2018-3712...

PT-2018-16136

Name of the Vulnerable Software and Affected Versions serve versions prior to 6.4.9 Description The issue arises from the software's failure to properly handle %2e . and %2f / characters in paths, allowing a malicious user to traverse the directory tree and list the contents of any directory the...

CVE-2018-3712: Improper Limitation of a Pathname to a Restricted Directory

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...

PT-2018-16142 · Node.Js · Serve

Name of the Vulnerable Software and Affected Versions: serve node module affected versions not specified Description: The issue is related to improper handling of URL encoding, allowing access to ignored files if a filename is URL encoded. This can potentially lead to unauthorized access to...

CVE-2018-3718: Improper Handling of URL Encoding (Hex Encoding)

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

CVE-2018-3809

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

@11ty/eleventy (0.3.3), @amlopez333/mrhyde (>=0.4.2, <=0.4.8) +190 more potentially affected by CVE-2018-3809 via serve (>=1.2.0, <=6.5.8)

serve NPM version =1.2.0, =0.4.2, =2018.4.29-7, =2018.4.29-8, =2018.5.11-6, =1.1.11, =1.1.1, =0.2.0, =0.4.0, =0.4.10, =2.0.0-beta.20, =0.0.1-prealpha, =0.0.1-0, =0.0.1-10 - @iamstarkov/html-sketchapp-cli 0.2.0 and more Source cves: CVE-2018-3809 Source advisory: MEND:CVE-2018-3809...

CVE-2018-3809

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

CVE-2018-3809

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

CVE-2018-3809

The CVE-2018-3809 entry refers to the Node.js module serve (v6.5.3) exposing information via directory listings and bypassing ignore rules on case-insensitive file systems. Technical details from connected records show that versions before 7.0.0 are affected and allow reading ignored files or lis...

PT-2018-16205

Name of the Vulnerable Software and Affected Versions serve versions prior to 7.0.0 Description The issue allows information exposure through directory listings, enabling access to files even when they are set to be ignored. This occurs in versions of serve before 7.0.0, specifically bypassing th...

CVE-2018-3809: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored...

Directory Traversal

serve is vulnerable to directory traversal attacks. The vulnerability exists due to the improper user input sanitization where having a ./ dot slash, or the use of uppercase characters for serve hosted in Mac OS, in the input can cause directory traversal attacks...

Node.js third-party modules: [serve] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in serve. It allows reading local files on the target server. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

Node.js third-party modules: [serve] Stored XSS in the filename when directories listing

I would like to report a Stored XSS issue in module serve It allows executing malicious javascript code in the user's browser. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

ISC BIND Multiple Denial of Service Vulnerabilities (May 2018)

ISC BIND is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:isc:bind";...

FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)

ISC reports : An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can le...

BIND -- multiple vulnerabilities

ISC reports: An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can lea...