CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

PT-2023-24665

Name of the Vulnerable Software and Affected Versions Vite versions prior to 2.9.16 Vite versions prior to 3.2.7 Vite versions prior to 4.0.5 Vite versions prior to 4.1.5 Vite versions prior to 4.2.3 Vite versions prior to 4.3.9 Description The issue involves a security risk in Vite where the...

Vite 安全漏洞

Vite is a new front-end building tool from Vite open source. A security vulnerability exists in Vite versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9. An attacker exploits the vulnerability to read files from the application's Vite root path...

Dev mode Path traversal

Description Vite is misconfigured within nuxt to permit any file to be retrieved from the file system. Root Cause Vite configuration has strict set to false. Exploitation Requirements: + Server must be running in developer mode Vulnerability can be exploited using paths like the following...

Malicious code in react-server-dom-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38bacfa115db90fd1da93cce7d4c6fd3d152db72097f0aea4c235e7bb27fe64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5673 Malicious code in react-server-dom-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38bacfa115db90fd1da93cce7d4c6fd3d152db72097f0aea4c235e7bb27fe64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@bn-digital/vite (>=1.11.2 <=1.11.4), purplet (>=2.0.0-next-pr55.3 <=2.0.0-next.18) +2 more potentially affected by CVE-2022-35204 via vite (>=3.0.0-alpha.10 <=3.0.0-alpha.9)

vite NPM version =3.0.0-alpha.10, =1.11.2, =2.0.0-next-pr55.3, =0.4.0, =0.1.0, =0.3.0 Source cves: CVE-2022-35204 Source advisory: OSV:GHSA-MV48-HCVH-8JJ8...

@aem-vite/import-rewriter (=5.0.1), @aem-vite/vite-aem-plugin (>=1.0.0 <=1.0.0-alpha.5) +200 more potentially affected by CVE-2022-35204 via vite (>=0.14.4 <=2.9.12)

vite NPM version =0.14.4, =1.0.0, =3.0.0-beta.5, =3.0.0-beta.2, =0.0.1, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.16 and more Source cves: CVE-2022-35204 Source advisory: OSV:GHSA-MV48-HCVH-8...

GHSA-MV48-HCVH-8JJ8 Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service...

CVE-2022-35204

Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service...

CVE-2022-35204

Vitejs Vite before v2.9.13 is vulnerable to directory traversal via a crafted URL to the victim’s service; update to v2.9.13 or later to resolve the issue (per PT-2022-22631).

CVE-2022-35204

Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service...

CVE-2022-35204

Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service...

PT-2022-22631 · Vitejs · Vite

Name of the Vulnerable Software and Affected Versions: Vitejs Vite versions prior to 2.9.13 Description: The issue allows attackers to perform a directory traversal via a crafted URL to the victim's service. This can be achieved by sending a specifically designed URL to the victim's service,...

Vite 路径遍历漏洞

Vite is a new front-end build tool open-sourced by Vite. A security vulnerability exists in versions prior to Vite v2.9.13 that stems from a vulnerability that allows an attacker to perform directory traversal of a victim's service via a crafted URL...

CVE-2022-2819

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211...

Malicious Package

Overview react-server-dom-vite is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

@internxt/cli (>=1.0.5 <=1.2.2), @latitude-data/cli (>=0.0.29 <=1.11.0-canary.8) +10 more potentially affected by CVE-2020-7660 via serialize-javascript (>=7.0.0 <=7.0.2)

serialize-javascript NPM version =7.0.0, =1.0.5, =0.0.29, =0.7.5, =1.3.0, =0.1.0, =1.0.7, =0.2.0, =0.7.0-alpha.6 Source cves: CVE-2020-7660 Source advisory: SNYK:JS-SERIALIZEJAVASCRIPT-570062...

vite-envogue.de XSS vulnerability

Open Bug Bounty ID: OBB-677206 Description| Value ---|--- Affected Website:| vite-envogue.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...