781 matches found
Malicious Package
Overview web-self-serve-ads is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...
Django DoS in django.views.static.serve
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...
Relative Path Traversal vulnerability in StaticDir server
Description There is a relative path traversal vulnerability in the serve module of the extra crate. An attacker can simply request a relative path and access files outside of the configured directory root. Proof of Concept With a static folder in the project directory: rs // main.rs use...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
CVE-2022-28380
CVE-2022-28380 affects the rc-httpd component in plan9front (9front fork) up to 2022-03-31. The issue enables directory traversal via a crafted path containing ..%2f when serve-static is used, exposing potential access to restricted files. The connected sources confirm the vulnerable component an...
Ice Cream Machine Hackers Sue McDonald's for $900 Million
Kytch alleges that the Golden Arches crushed its business—and left soft serve customers out in the cold...
Directory Traversal
Overview github.com/valyala/fasthttp is a fast HTTP server and client API. Affected versions of this package are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This...
Stack overflow
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL...
The McDonald’s Ice Cream Machine Hacking Saga Has a New Twist
The cold war between a startup and a soft-serve machine manufacturer is heating up, thanks to a newly released trove of internal emails...
Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...
GHSA-4448-RC82-FCR7 Path Traversal in serve-here.js
Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths...
@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @pl-test/c (>=1.1.0, <=1.1.1) +5 more potentially affected by CVE-2018-3718 via serve (>=6.0.0, <=6.4.10)
serve NPM version =6.0.0, =0.0.1-prealpha, =1.1.0, =7.1.9, =4.1.8, =5.0.0 Source cves: CVE-2018-3718 Source advisory: OSV:GHSA-5RC4-8QQH-VQ7F...
vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...
GHSA-5RC4-8QQH-VQ7F vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...
Path traversal in rollup-plugin-serve
Overview Path traversal in rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation. Recommendation Upgrade to version 1.0.2 or later References - CVE - GitHub Advisory...
Path traversal in rollup-plugin-serve
Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation...
rollup.config.flow (4.0.0), tslib-cli (>=1.0.0, <=5.4.1) potentially affected by CVE-2020-7684 via rollup-plugin-serve (1.0.1)
rollup-plugin-serve NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on rollup-plugin-serve and may be impacted: - rollup.config.flow 4.0.0 - tslib-cli =1.0.0, =5.4.1 Source cves: CVE-2020-7684 Source advisory: OSV:GHSA-4J46-MP85-MV8C...