Cross-site Scripting (XSS)

serve-static is vulnerable to Cross-site Scripting XSS. The vulnerability is due to passing untrusted user input, even after sanitization, to the redirect function, which may lead to the execution of untrusted code...

01-numacert (>=1.0.0, <=3.0.0), 02-infrastructure (1.0.0) +20269 more potentially affected by CVE-2024-43800 via serve-static (>=1.0.1, <=1.15.0)

serve-static NPM version =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.0.3, =1.0.11 - 2-angular 1.0.0 - 20190403-utils 1.0.0 - 20231122-npm 1.0.0 - 2048.io 0.0.1 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

@daiyu-5577/quickbuild (>=1.2.1, <=2.6.8), @dataunions/default-join-server (>=3.0.0-alpha.1, <=3.0.3) +14 more potentially affected by CVE-2024-43800 via serve-static (>=2.0.0-beta.1, <=2.0.0-beta.2)

serve-static NPM version =2.0.0-beta.1, =1.2.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =2.0.0, =3.0.3, =4.2.0, =0.2.0, =0.0.1, =0.1.0, =0.55.1, =4.89.0, =1.27.20, =5.0.0-beta.1, =4.0.0, =0.2.0, =0.5.16 and more Source cves: CVE-2024-43800 Source advisory: OSV:GHSA-CM22-4G7W-348P...

serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

CVE-2024-43800

A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

DEBIAN-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49094 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49155 CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-5

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

UBUNTU-CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

CVE-2024-43800 is present in IBM Maximo AI Service (Maximo AI Service 9.1.0 per the bulletin). The vulnerability affects the serve-static package where untrusted input passed to redirect() could execute untrusted code, even after sanitization. It is patched in serve-static 1.16.0. Remediation per...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

CVE-2024-43800 serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

PT-2024-30668 · Unknown +1 · Statics-Server +1

Name of the Vulnerable Software and Affected Versions: serve-static versions prior to 1.16.0 Description: The issue allows execution of untrusted code by passing untrusted user input to the redirect function, even after sanitizing it. This can be exploited if an attacker controls the input to...

CVE-2024-8370 Grocy SVG File Upload recipepictures cross site scripting

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument forceserveas with the input picture' leads to cross site scripting. T...

GO-2023-2097 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve...