CVE-2018-3787

Path traversal in simplehttpserver v0.2.1 allows listing any file on the server...

CVE-2018-3787

The CVE-2018-3787 vulnerability affects the Python-based simplehttpserver project. Affected versions are prior to 0.2.1, where the server concatenates the requested URL path to the web root, enabling path traversal and the listing of arbitrary server files. Impact described across multiple source...

CVE-2018-3787

Path traversal in simplehttpserver v0.2.1 allows listing any file on the server...

PT-2018-16204 · Unknown · Simplehttpserver

Name of the Vulnerable Software and Affected Versions: simplehttpserver versions prior to 0.2.1 Description: The issue allows for path traversal, enabling the listing of any file on the server. Recommendations: For versions prior to 0.2.1, update to version 0.2.1 or later to resolve the issue...

Directory Traversal

simplehttpserver is vulnerable to directory traversal. An attacker is able to exploit the vulnerability to retrieve and view system files by using the characters ../ in the directory path of the URL...

Stored Cross-Site Scripting in simplehttpserver

Simplehttpserver prior to version 0.1.0 are vulnerable to stored cross-site scripting XSS. To be exploited an attacker needs to control the filename of a file that is used in the directory listing output. This version is patched in 0.1.0...

GHSA-JRHJ-2J3Q-XF3V Stored Cross-Site Scripting in simplehttpserver

Simplehttpserver prior to version 0.1.0 are vulnerable to stored cross-site scripting XSS. To be exploited an attacker needs to control the filename of a file that is used in the directory listing output. This version is patched in 0.1.0...

h-include (1.0.0), hinclude (>=1.0.1, <=1.1.0) +2 more potentially affected by CVE-2018-3716 via simplehttpserver (0.0.6)

simplehttpserver NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on simplehttpserver and may be impacted: - h-include 1.0.0 - hinclude =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2018-3716 Source advisory: OSV:GHSA-JRHJ-2J3Q-XF3V...

Microsoft Enterprise Mode Site List Manager - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor ============= www.microsoft Product =========== Enterprise Mode Site List Manager versions1/2 You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain...

Simplehttpserver Cross-Site Scripting Vulnerability

simplehttpserver is an HTTP file server. A cross-site scripting vulnerability exists in simplehttpserver, which stems from the program's lack of filename checksums. An attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names...

CVE-2018-3716: Improper Neutralization of Input During Web Page Generation

simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names...

Node.js third-party modules: [simplehttpserver] List any file in the folder by using path traversal.

I would like to report Path Traversal in simplehttpserver. It allows to list any file in another folder of web root. Module module name: simplehttpserver version: 0.1.1 npm page: https://www.npmjs.com/package/simplehttpserver Module Description 'simpehttpserver' is an simple imitation of python's...

ModbusPal 1.6b XML External Entity Injection

Exploit Title: ModbusPal XXE Injection + Date: 05-08-2018 + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version: 1.6b + Tested on: Ubuntu 16.04 with Java 1.8.0151...

ModbusPal 1.6b - XML External Entity Injection Vulnerability

Exploit for java platform in category web applications + Exploit Title: ModbusPal XXE Injection + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version: 1.6b + Test...

ModbusPal 1.6b - XML External Entity Injection

ModbusPal 1.6b - XML External Entity Injection + Exploit Title: ModbusPal XXE Injection + Date: 05-08-2018 + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version:...

Stored Cross-Site Scripting

Overview All versions of simplehttpserver are vulnerable to stored cross-site scripting XSS. To be exploited an attacker needs to control the filename of a file that is used in the directory listing output. Recommendation No fix is currently available for this vulnerability. It is our...

Cross-site Scripting (XSS)

simplehttpserver is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of file names when displaying the affected file names...

sshLooter - Script To Steal Passwords From SSH

Script to steal passwords from SSH. Install git clone https://github.com/mthbernardes/sshLooter.git cd sshLooter Configuration Edit the script on install.sh, and add your telegram bot api, and your userid. Call the @botfather on telegram to create a bot and call the @userinfobot to get your user...

Tenda AC15 Router - Remote Code Execution

!/usr/bin/env python EDB Note Source: https://www.fidusinfosec.com/remote-code-execution-cve-2018-5767/ import urllib2 import struct import time import socket from optparse import import SimpleHTTPServer import SocketServer import threading import sys import os import subprocess ARMREVSHELL =...