128981semzub (=1.0.1), 1food-menu (>=0.3.0 <=0.3.7) +3131 more potentially affected by CVE-2024-45811 via vite (>=4.0.0 <=4.5.3)

vite NPM version =4.0.0, =0.3.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.3 and more Source cves: CVE-2024-45811 Source advisory: OSV:GHSA-9CWX-2883-4WFX...

GHSA-9CWX-2883-4WFX Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

GHSA-9CWX-2883-4WFX vulnerabilities

Vulnerabilities for packages: vite...

GHSA-9CWX-2883-4WFX vulnerabilities

Vulnerabilities for packages: vite...

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

Vite 跨站脚本漏洞

Vite is a new front-end builder tool open-sourced by Vite. A cross-site scripting vulnerability exists in Vite. An attacker exploiting this vulnerability could perform a cross-site scripting attack...

PT-2024-31792 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: The contents of arbitrary files can be returned to the browser. @fs denies access ...

Vite 访问控制错误漏洞

Vite is a new front-end builder tool from the Vite open source. Vite suffers from an access control error vulnerability that stems from the fact that the contents of any file can be returned to the browser...

PT-2024-31793 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: A DOM Clobbering vulnerability was discovered in Vite when building scripts to...

The vulnerability of the Vite application development local server, related to access control deficiencies, allows a hacker to execute arbitrary code.

The vulnerability of the Vite application development local server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-31207

A flaw was found in the Node.js Vite package. When configuring the "server.fs.deny" server option to deny requests that include a pattern with directories such as /foo//, the requests were still being allowed. This can potentially expose files or directories containing sensitive information. Only...

CVE-2024-31207

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207

CVE-2024-31207 (Vite) : The vulnerability is in Vite’s server.fs.deny logic, which does not deny requests for patterns containing directories. This could allow access to unintended files or paths during development. Affected versions include 2.9.18 and 3.2.10 up to 5.2.6, 5.1.7, 5.0.13, and 4.5.3...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

Path Traversal

vite is vulnerable to Path Traversal. The vulnerability is due to mishandling patterns containing directories caused by the server.fs.deny option. This allows an attacker to gain unauthorized access to certain files...

Vite 安全漏洞

Vite is a new front-end builder tool open-sourced by Vite. A security vulnerability exists in Vite that stems from server.fs.deny not rejecting requests with directory patterns. Affected products and versions: Vite versions 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0...

@angular-devkit/build-angular (>=17.3.0 <=17.3.3), @bebasebuild/basebuild (>=2.0.0-beta.0 <=2.0.0-beta.2) +57 more potentially affected by CVE-2024-31207 via vite (>=5.1.0 <=5.1.6)

vite NPM version =5.1.0, =17.3.0, =2.0.0-beta.0, =1.0.8, =17.3.0, =17.3.0, =0.0.0-6ba0891f, =0.0.0-6ba0891f, =0.0.0-6ba0891f, =6.0.12, =6.0.13, =6.0.13, =6.0.13, =6.0.13, =6.0.25 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

@akrc/vidocs (>=0.0.0 <=0.0.2), @alexzzz/npms (>=0.0.5 <=0.2.0) +92 more potentially affected by CVE-2024-31207 via vite (>=3.0.0 <=3.2.1)

vite NPM version =3.0.0, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220718083044, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =5.1.0, =5.1.2 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...