https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 10:35:37 +0000 https://cve.radiocsirt.org/vuln/cve-2017-16224 <p><strong>Affected:</strong> HackerOne st node module</p> <p>st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (&#34;%2e%2e&#34;, &#34;%2e.&#34;, &#34;.%2e&#34;).</p> <p><strong>Affected:</strong> HackerOne st node module</p> <p>st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (&#34;%2e%2e&#34;, &#34;%2e.&#34;, &#34;.%2e&#34;).</p> https://cve.radiocsirt.org/vuln/cve-2017-16224