rollup-plugin-serve path traversal vulnerability

rollup-plugin-serve is a module bundler package for JavaScript. A path traversal vulnerability exists in rollup-plugin-serve, which stems from a failure to clear a path when the program performs a readFile operation. No details of the vulnerability are available at this time...

CVE-2020-7684

This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation...

CVE-2020-7684

CVE-2020-7684 affects the npm package rollup-plugin-serve. The vulnerability is a path traversal in the readFile operation due to lack of path sanitization, allowing access to files outside the destination. Reported impact includes information disclosure and potential file access; exploitation de...

CVE-2020-7684 Directory Traversal

This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation...

@ahone/svg2canvas (>=0.0.1 <=0.0.7), @aliyun-sls/sls-app-loader (>=0.0.12 <=0.0.18) +357 more potentially affected by CVE-2020-7684 via rollup-plugin-serve (>=0.1.0 <=3.0.0)

rollup-plugin-serve NPM version =0.1.0, =0.0.1, =0.0.12, =0.1.0, =0.0.1-alpha.1, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =7.0.1, =7.0.1, =13.0.0 and more Source cves: CVE-2020-7684 Source advisory: SNYK:JS-ROLLUPPLUGINSERVE-585897...

Directory Traversal

Overview rollup-plugin-serve is a rollup plugin to serve the bundle. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation. PoC by JHU System Security Lab Step 1: start a server var server = require"rollup-plugin-serve"; serve...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

WebAuthn Passwordless Authentication Now Available for Atlassian Products

Atlassian solutions are widely used in the software development industry. Many teams practicing agile software development rely on these applications to manage their projects. Issue-tracking application Jira, Git repository BitBucket, continuous integration and deployment server Bamboo, and team...

WebAuthn Passwordless Authentication Now Available for Atlassian Products

Atlassian solutions are widely used in the software development industry. Many teams practicing agile software development rely on these applications to manage their projects. Issue-tracking application Jira, Git repository BitBucket, continuous integration and deployment server Bamboo, and team...

bind security, bug fix, and enhancement update

32:9.11.13-3 - Fix rwlock to be thread-safe 1740511 32:9.11.13-2 - Release GeoIP data on reload 1790879 32:9.11.13-1 - Update to 9.11.13 32:9.11.12-5 - Report failures on systemctl reload 1739428 32:9.11.12-4 - dhcp: Use monotonic time for detecting time jumps if available 1729211 32:9.11.12-3 -...

CVE-2018-5737

A flaw was found in the "serve-stale" feature as implemented in bind. Problematic interaction between serve-stale feature and NSEC aggressive negative caching could cause denial of service...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

virt:ol security update

hivex libguestfs 1:1.38.4-14.0.1 - Config supermin to use host yum.conf in ol8 Orabug: 29319324 - Set DISTROORACLELINUX correspeonding to ol 1:1.38.4-14 - v2v: use -T as argument of scp when copying vmx files via ssh resolves: rhbz1738886 Fri Jun 28 2019 Danilo de Paula - Rebuild all virt package...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

CVE-2019-16777

The CVE-2019-16777 entry affects the npm CLI for versions prior to 6.13.4, which are vulnerable to Arbitrary File Overwrite. The issue allows overwriting globally-installed binaries (e.g., a serve binary) during subsequent package installations, including when --ignore-scripts is used. This behav...

Open Redirect

Overview Versions of serveprior to 11.3.2 are vulnerable to Open Redirect. The package redirected requests to third-party websites for URLs such as localhost:5000//example.com/index. The user would be redirected to example.com. Recommendation Upgrade to version 11.3.2 or later. References...

Security update for helm (moderate)

openSUSE Security Update: Security update for helm Announcement ID: openSUSE-SU-2019:1703-1 Rating: moderate References: 1118897 1118898 1118899 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 An update that fixes thr...

Serve-here.js path traversal vulnerability

serve-here.js is an HTTP static file server. A path traversal vulnerability in serve-here.js v1.1.3 and prior versions, which arises from a failure of a networked system or product to properly filter for special elements in the path of a resource or file, can be exploited by an attacker to access...

CVE-2019-5444

Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...