CVE-2024-43800

...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.34.0 security update & enhancements

Release of OpenShift Serverless Logic 1.34.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.11

Red Hat OpenShift Service Mesh Containers for 2.4.11 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules (CVE-2024-39338, CVE-2024-43800, CVE-2024-43799, CVE-2024-43796).

Summary IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios CVE-2024-39338, expressjs serve-static CVE-2024-43800, pillarjs send CVE-2024-43799 and expressjs express CVE-2024-43796. This bulletin identifies the steps to take to address the...

Cross-site Scripting (XSS)

serve-static is vulnerable to Cross-site Scripting XSS. The vulnerability is due to passing untrusted user input, even after sanitization, to the redirect function, which may lead to the execution of untrusted code...

01-numacert (>=1.0.0, <=3.0.0), 02-infrastructure (1.0.0) +20271 more potentially affected by CVE-2024-43800 via serve-static (>=1.0.1, <=1.15.0)

serve-static NPM version =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.0.3, =1.0.11 - 2-angular 1.0.0 - 20190403-utils 1.0.0 - 20231122-npm 1.0.0 - 2048.io 0.0.1 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

@daiyu-5577/quickbuild (>=1.2.1, <=2.6.8), @dataunions/default-join-server (>=3.0.0-alpha.1, <=3.0.3) +14 more potentially affected by CVE-2024-43800 via serve-static (>=2.0.0-beta.1, <=2.0.0-beta.2)

serve-static NPM version =2.0.0-beta.1, =1.2.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =2.0.0, =3.0.3, =4.2.0, =0.2.0, =0.0.1, =0.1.0, =0.55.1, =4.89.0, =1.27.20, =5.0.0-beta.1, =4.0.0, =0.2.0, =0.5.16 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

CVE-2024-43800

A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

DEBIAN-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49094 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49155 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-5

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

UBUNTU-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

CVE-2024-43800 is present in IBM Maximo AI Service (Maximo AI Service 9.1.0 per the bulletin). The vulnerability affects the serve-static package where untrusted input passed to redirect() could execute untrusted code, even after sanitization. It is patched in serve-static 1.16.0. Remediation per...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...