Cross-site Scripting (XSS)

serve-static is vulnerable to Cross-site Scripting XSS. The vulnerability is due to passing untrusted user input, even after sanitization, to the redirect function, which may lead to the execution of untrusted code...

01-numacert (>=1.0.0 <=3.0.0), 02-infrastructure (=1.0.0) +18530 more potentially affected by CVE-2024-43800 via serve-static (>=1.0.1 <=1.15.0)

serve-static NPM version =1.0.1, =1.0.0, =1.0.0, =1.0.3, =0.1.0, =0.2.0, =0.2.2 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

CVE-2024-43800

A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49094 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49155 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-5

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

DEBIAN-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

UBUNTU-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

CVE-2024-43800 is present in IBM Maximo AI Service (Maximo AI Service 9.1.0 per the bulletin). The vulnerability affects the serve-static package where untrusted input passed to redirect() could execute untrusted code, even after sanitization. It is patched in serve-static 1.16.0. Remediation per...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

PT-2024-30668 · Unknown +1 · Statics-Server +1

Name of the Vulnerable Software and Affected Versions: serve-static versions prior to 1.16.0 Description: The issue allows execution of untrusted code by passing untrusted user input to the redirect function, even after sanitizing it. This can be exploited if an attacker controls the input to...

GHSA-3MPF-RCC7-5347 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Summary When using serveStatic with deno, it is possible to directory traverse where main.ts is located. My environment is configured as per this tutorial https://hono.dev/getting-started/deno PoC bash $ tree . ├── deno.json ├── deno.lock ├── main.ts ├── README.md └── static └── a.txt source jsx...

Hono 安全漏洞

Hono is a web framework written in TypeScript from the Hono community. A security vulnerability exists in Hono versions prior to 4.2.7, which stems from using serveStatic with deno to traverse the directory where main.ts is located, potentially retrieving unexpected files...

SUSE CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...