Path traversal in rollup-plugin-serve

Overview Path traversal in rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation. Recommendation Upgrade to version 1.0.2 or later References - CVE - GitHub Advisory...

Path traversal in rollup-plugin-serve

Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...

rollup.config.flow (4.0.0), tslib-cli (>=1.0.0, <=5.4.1) potentially affected by CVE-2020-7684 via rollup-plugin-serve (1.0.1)

rollup-plugin-serve NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on rollup-plugin-serve and may be impacted: - rollup.config.flow 4.0.0 - tslib-cli =1.0.0, =5.4.1 Source cves: CVE-2020-7684 Source advisory: OSV:GHSA-4J46-MP85-MV8C...

GHSA-4J46-MP85-MV8C Path traversal in rollup-plugin-serve

Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...

PT-2021-12084 · Unknown · Golang-Nanoauth

Name of the Vulnerable Software and Affected Versions: golang-nanoauth versions v0.0.0-20160722212129-ac0cc4484ad4 through v0.0.0-20200131131040-063a3fb69896 Description: The issue concerns a global bypass of authentication in the golang-nanoauth library. When the ListenAndServe function is calle...

GHSA-9VHV-P9R7-RM53 HTML tag injection

Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page...

HTML tag injection

Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page...

Cesanta Mongoose 缓冲区错误漏洞

Mongoose is a C/C++ network library. An out-of-bounds write vulnerability exists in the mghttpservefile function in Cesanta Mongoose 7.0. An attacker can exploit this vulnerability via a connection request to cause an out-of-bounds write after the memory pool is exhausted...

Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 10.0.2 or later...

@ieremeev/app (>=3.0.1, <=3.2.4), xtal-test (>=0.0.1, <=0.0.10) potentially affected by unknown CVE via serve (10.0.0)

serve NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serve and may be impacted: - @ieremeev/app =3.0.1, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-CPGR-WMR9-QXV4...

GHSA-CPGR-WMR9-QXV4 Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 10.0.2 or later...

@ieremeev/app (>=3.0.1, <=3.2.4), xtal-test (>=0.0.1, <=0.0.10) potentially affected by unknown CVE via serve (10.0.0)

serve NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serve and may be impacted: - @ieremeev/app =3.0.1, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-XW79-HHV6-578C...

GHSA-XW79-HHV6-578C Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later...

Cross-Site Scripting in serve

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later...

GHSA-48GC-5J93-5CFQ Path Traversal in serve

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later...

@ieremeev/app (>=3.0.1, <=4.1.1), @meetup/swarm-docs (0.7.10-beta.0) +7 more potentially affected by unknown CVE via serve (>=10.0.0, <=10.1.1)

serve NPM version =10.0.0, =3.0.1, =0.1.0, =0.0.12, =0.0.0, =0.0.10, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-48GC-5J93-5CFQ...

Path Traversal in serve

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later...

GHSA-WM7Q-RXCH-43MX Byass due to validation before canonicalization in serve

Versions of serve before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. const serve = require'serve' const server =...

Byass due to validation before canonicalization in serve

Versions of serve before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. const serve = require'serve' const server =...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @pl-test/c (>=1.1.0, <=1.1.1) +5 more potentially affected by unknown CVE via serve (>=6.0.0, <=6.4.10)

serve NPM version =6.0.0, =0.0.1-prealpha, =1.1.0, =7.1.9, =4.1.8, =5.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-WM7Q-RXCH-43MX...