Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

SUSE CVE-2014-3744

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path...

Open Redirect in st

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

CVE-2017-16224

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

Cross site request forgery (csrf)

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

CVE-2017-16224

The CVE-2017-16224 entry concerns the Node.js module st, which serves static files. A crafted request can trigger an HTTP 301 redirect to an entirely different domain. This requires st to be serving from the server root (/) rather than a subdirectory (e.g., /static/). The redirect URL ends with U...

Directory traversal

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path...

UBUNTU-CVE-2014-3744

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path...

CVE-2014-3744

The CVE-2014-3744 issue is a directory traversal vulnerability in the Node.js st module prior to 0.2.5. Vulnerable versions mishandle URL-encoded dots (e.g., %2e and %2e%2e), allowing remote attackers to read arbitrary files on the server. Evidence from multiple sources confirms the affected comp...

Open Redirect

Overview st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers trea...