CVE-2015-1032: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search...

CVE-2015-1164: Undefined Security Weakness

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the PATHINFO to the default URI...

PT-2015-5139

Name of the Vulnerable Software and Affected Versions serve-static versions prior to 1.6.5 serve-static versions 1.7.x prior to 1.7.2 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in th...

CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

PYSEC-2015-6

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

EUVD-2015-0015

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

Django 'django.views.static.serve()' function denial of service vulnerability

Django is an open source web application framework written in Python . A denial of service vulnerability exists in the Django 'django.views.static.serve' function, which could be exploited by a remote attacker to trigger a denial of service due to excessive resource consumption...

Node.js 'serve-static' module open redirection vulnerability

Node.js is a platform built on the Chrome JavaScript runtime for building fast, easily extensible web applications. An open redirect vulnerability exists in the Node.js 'serve-static' module, which can be exploited by an attacker to redirect users to a potentially malicious website, which could...

CVE-2014-7829

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence o...

DEBIAN-CVE-2014-7829

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence o...

CVE-2014-7829

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence o...

Directory traversal

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence o...

CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

DEBIAN-CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

Information disclosure

The American Express Serve aka com.serve.mobile application @7F0901E4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6876

The American Express Serve aka com.serve.mobile application @7F0901E4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6876

The CVE-2014-6876 entry concerns the American Express Serve Android app (com.serve.mobile). Affected component: SSL/TLS certificate validation in the app; root cause: the application does not verify X.509 certificates from SSL servers. Impact: enables man-in-the-middle attackers to spoof servers ...

PT-2014-7552

Name of the Vulnerable Software and Affected Versions American Express Serve application version @7F0901E4 Description The issue concerns the American Express Serve application for Android, which fails to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof...

CVE-2014-6876: Undefined Security Weakness

The American Express Serve aka com.serve.mobile application @7F0901E4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...