min-http-server cross-site scripting vulnerability

min-http-server is a lightweight http static resource server . A cross-site scripting vulnerability exists in min-http-server all versions. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...

Path Traversal

Overview All versions of static-resource-server are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

Node.js third-party modules: [min-http-server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "min-http-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: min-http-server version: 1.0.6 npm page:...

CVE-2018-16493

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

Path traversal

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

CVE-2018-16493

CVE-2018-16493 is a path traversal flaw in the Node.js static-resource-server module (v1.7.2) that allows an unauthenticated attacker to read arbitrary files by crafting URL path traversals (e.g., /../). The NVD lists a high CVSSv3 base score of 7.5 and medium CVSSv2 of 5.0. Exploit details are n...

Node.js third-party modules: [static-resource-server] Path Traversal allows to read content of arbitrary file on the server

Module module name: static-resource-server version: 1.7.2 npm page: https://www.npmjs.com/package/static-resource-server Module Description A tiny http server that provides local static resource access Module Stats Replace stats below with numbers from npm’s module page: 0 downloads in the last d...