https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:28:58 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-257735 EUVD-2026-257735 https://cve.radiocsirt.org/vuln/euvd-2026-257735 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43799 <p>Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.</p> <p>Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43799 https://cve.radiocsirt.org/vuln/ghsa-m6fv-jmcg-4jfg <p><strong>Affected:</strong> npm: send</p> <p>### Impact</p> <p>passing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in send 0.19.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> <p><strong>Affected:</strong> npm: send</p> <p>### Impact</p> <p>passing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in send 0.19.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> https://cve.radiocsirt.org/vuln/ghsa-m6fv-jmcg-4jfg https://cve.radiocsirt.org/vuln/msrc_cve-2024-43799 msrc_CVE-2024-43799 https://cve.radiocsirt.org/vuln/msrc_cve-2024-43799 https://cve.radiocsirt.org/vuln/rhba-2024:10184 <p>browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack send: Code Execution Vulnerability in Send Library</p> <p>browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack send: Code Execution Vulnerability in Send Library</p> https://cve.radiocsirt.org/vuln/rhba-2024:10184 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43799 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-send, Ubuntu:18.04:LTS: node-send, Ubuntu:20.04:LTS: node-send, Ubuntu:22.04:LTS: node-send, Ubuntu:24.04:LTS: node-send</p> <p>Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-send, Ubuntu:18.04:LTS: node-send, Ubuntu:20.04:LTS: node-send, Ubuntu:22.04:LTS: node-send, Ubuntu:24.04:LTS: node-send</p> <p>Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43799 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197