CVE-2018-16478

CVE-2018-16478 affects the Python-like HTTP server module simplehttpserver , version ≤ 0.2.1. The root cause is a path traversal vulnerability that allows a URL to navigate via symlinks, enabling an attacker to list files outside the web root (information disclosure). Documented impact: informati...

CVE-2018-3716

CVE-2018-3716 affects the simplehttpserver Node.js module. The vulnerability is a stored XSS in directory listings caused by lack of validation/sanitization of file names fed into HTML output. Exploitation requires an attacker-controlled filename in the listing; the XSS payload is reflected in th...

CVE-2018-3787

The CVE-2018-3787 vulnerability affects the Python-based simplehttpserver project. Affected versions are prior to 0.2.1, where the server concatenates the requested URL path to the web root, enabling path traversal and the listing of arbitrary server files. Impact described across multiple source...