8668 matches found
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
Summary If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code execution in the context of the web server’s domain. Details SWS generally does not perform escaping of HTML entities on any value...
CVE-2024-27041
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev-dm.dc in amdgpudmfini Since 'adev-dm.dc' in amdgpudmfini might turn out to be NULL before the call to dcenabledmubnotifications, check beforehand to ensure there will not be a possible...
CVE-2024-27041 drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev-dm.dc in amdgpudmfini Since 'adev-dm.dc' in amdgpudmfini might turn out to be NULL before the call to dcenabledmubnotifications, check beforehand to ensure there will not be a possible...
CVE-2024-27041
A NULL pointer dereference vulnerability exists in the Linux kernel within the drm/amd/display component. The issue stems from improper handling of the adev->dm.dc variable in the amdgpu_dm_fini() function, which could be NULL before the call to dc_enable_dmub_notifications(). Additionally, se...
CVE-2024-27041 drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev-dm.dc in amdgpudmfini Since 'adev-dm.dc' in amdgpudmfini might turn out to be NULL before the call to dcenabledmubnotifications, check beforehand to ensure there will not be a possible...
CVE-2024-27041 drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev-dm.dc in amdgpudmfini Since 'adev-dm.dc' in amdgpudmfini might turn out to be NULL before the call to dcenabledmubnotifications, check beforehand to ensure there will not be a possible...
CVE-2024-32966
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
DEBIAN-CVE-2024-26988
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential staticcommandline memory overflow We allocate memory of size 'xlen + strlenbootcommandline + 1' for staticcommandline, but the strings copied into staticcommandline are extracommandline and commandline,...
UBUNTU-CVE-2024-26988
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential staticcommandline memory overflow We allocate memory of size 'xlen + strlenbootcommandline + 1' for staticcommandline, but the strings copied into staticcommandline are extracommandline and commandline,...
CVE-2024-32966
The CVE-2024-32966 issue affects Static Web Server (SWS) when directory listings are enabled and a user with upload rights can name files. The directory listing code embeds file/directory names directly into HTML without escaping, enabling stored XSS via malicious file names (e.g., .txt). This ca...
CVE-2024-32966 Stored Cross-site Scripting in directory listings via file names in static-web-server
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
CVE-2024-32966
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
CVE-2024-26988 init/main.c: Fix potential static_command_line memory overflow
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential staticcommandline memory overflow We allocate memory of size 'xlen + strlenbootcommandline + 1' for staticcommandline, but the strings copied into staticcommandline are extracommandline and commandline,...
Fedora 39 : python-aiohttp (2024-e0057e6044)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e0057e6044 advisory. Security update for CVE-2024-27306 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.5 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.4...
CVE-2024-32966: Improper Neutralization of Input During Web Page Generation
Static Web Server SWS is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a staticcommandline memory overflow...
Static Web Server security vulnerabilities
Static Web Server is a static web server from the German company Static Web Server. A security vulnerability exists in Static Web Server SWS versions 2.28.0 and earlier that originates from a vulnerability that allows an attacker to upload a malicious filename to execute JavaScript code in the we...
Fedora 38 : python-aiohttp (2024-f34786d26f)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f34786d26f advisory. Security update for CVE-2024-27306 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.5 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.4...
CVE-2024-32966
creationtimestamp| type| source ---|---|--- 2024-04-30 09:02:01+00:00| published-proof-of-concept| https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg...
SUSE CVE-2022-48657
In the Linux kernel, the following vulnerability has been resolved: arm64: topology: fix possible overflow in amufiesetup cpufreqgethwmaxfreq returns max frequency in kHz as unsigned int, while freqinvsetmaxratio gets passed this frequency in Hz as 'u64'. Multiplying max frequency by 1000 can...