https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:05:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-162460 EUVD-2026-162460 https://cve.radiocsirt.org/vuln/euvd-2026-162460 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43800 <p>serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.</p> <p>serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43800 https://cve.radiocsirt.org/vuln/ghsa-cm22-4g7w-348p <p><strong>Affected:</strong> npm: serve-static</p> <p>### Impact</p> <p>passing untrusted user input - even after sanitizing it - to `redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in serve-static 1.16.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> <p><strong>Affected:</strong> npm: serve-static</p> <p>### Impact</p> <p>passing untrusted user input - even after sanitizing it - to `redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in serve-static 1.16.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> https://cve.radiocsirt.org/vuln/ghsa-cm22-4g7w-348p https://cve.radiocsirt.org/vuln/msrc_cve-2024-43800 msrc_CVE-2024-43800 https://cve.radiocsirt.org/vuln/msrc_cve-2024-43800 https://cve.radiocsirt.org/vuln/rhba-2024:7523 <p>micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static</p> <p>micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static</p> https://cve.radiocsirt.org/vuln/rhba-2024:7523 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43800 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-serve-static, Ubuntu:18.04:LTS: node-serve-static, Ubuntu:20.04:LTS: node-serve-static, Ubuntu:22.04:LTS: node-serve-static, Ubuntu:24.04:LTS: node-serve-static, Ubuntu:25.10: node-serve-static, Ubuntu:26.04:LTS: node-serve-static</p> <p>serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-serve-static, Ubuntu:18.04:LTS: node-serve-static, Ubuntu:20.04:LTS: node-serve-static, Ubuntu:22.04:LTS: node-serve-static, Ubuntu:24.04:LTS: node-serve-static, Ubuntu:25.10: node-serve-static, Ubuntu:26.04:LTS: node-serve-static</p> <p>serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43800 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197