Directory Traversal

node-simple-router is vulnerable to directory traversal attacks. The attacks is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

Directory Traversal

simple-npm-registry is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

CVE-2017-16123

welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16132

simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16083

node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL...

CVE-2017-16083

CVE-2017-16083 corresponds to a directory traversal vulnerability in node-simple-router. The affected package resolves relative file paths, allowing an attacker to access files outside the intended directory by crafting URLs such as ../…/… to disclose sensitive files. Public references (GHSA, NPM...

CVE-2017-16132

simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16132

CVE-2017-16132 concerns simple-npm-registry, a local npm package cache. Multiple connected sources confirm a directory traversal vulnerability in simple-npm-registry: an attacker can craft a URL containing relative path sequences (e.g., ../../) to access files outside the intended directory root....

PT-2018-16140 · Unknown · Simplehttpserver

Name of the Vulnerable Software and Affected Versions: Simplehttpserver versions prior to 0.1.0 Description: The issue arises from a lack of validation of file names, leading to a Cross-Site Scripting vulnerability. An attacker can exploit this by controlling the filename of a file used in the...

SELA Buffer Error Vulnerability

SELA aka SimplE Lossless Audio is a lossless audio encoder/decoder. A stack buffer overflow vulnerability exists in the 'initapev2keys' function in the core/apev2.c file in SELA version 0.1.2-alpha. A detailed vulnerability description is not available at this time...

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

Code injection

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

CVE-2016-10555

The CVE-2016-10555 issue affects the jwt-simple library (Node.js). It arises because jwt.decode() does not strictly enforce the algorithm, allowing a malicious user to choose the JWT verification algorithm. If a server expects RSA but receives an HMAC-SHA with RSA’s public key, the public key cou...

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

CVE-2018-11626

SELA (aka SimplE Lossless Audio) v0.1.2-alpha is affected by a stack-based buffer overflow in the core/apev2.c init_apev2_keys function. This CVE entry identifies the vulnerable component and the root cause but does not provide any public details on affected platforms, versions beyond v0.1.2-alph...

CVE-2018-11626

SELA aka SimplE Lossless Audio v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c initapev2keys function...

CVE-2013-10032

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/getsimplecmsuploadexec.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

unboundid-ldapsdk: Incorrect Access Control vulnerability in process function in SimpleBindRequest class

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty...

CVE-2017-9635

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Amp...

Malicious Package

Overview Version 1.0.1 of simple-alipay contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.1 of this module is found install...