CVE-2018-3729

The CVE-2018-3729 entry is supported by multiple connected documents describing a path traversal flaw in the localhost-now Node.js module. Affected software: localhost-now prior to version 1.0.2 (as documented in GHSA-2GJG-5X33-MMP2 and OSV; HackerOne report H1:312889 corroborates). Root cause: l...

CVE-2019-5416

CVE-2019-5416 is a path traversal vulnerability in the localhost-now npm package (version 1.0.2). The underlying issue is inadequate URL/file path sanitization, allowing a remote attacker to read arbitrary files on the server by crafting traversals (e.g., ../). Multiple connected sources confirm ...