Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2016/04/20/11 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/96392 | Broken Link |
| https://nodesecurity.io/advisories/34 | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2016/04/20/11 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/96392 | Broken Link |
| https://nodesecurity.io/advisories/34 | Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 02:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2016/04/20/11 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/96392 - Broken Link | |
| References | () https://nodesecurity.io/advisories/34 - Patch, Vendor Advisory |
26 Sep 2023, 20:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:openjsf:serve-index:*:*:*:*:node.js:*:*:* | |
| References | (BID) http://www.securityfocus.com/bid/96392 - Broken Link | |
| First Time |
Openjsf serve-index
Openjsf |
Information
Published : 2017-01-23 21:59
Updated : 2024-11-21 02:39
NVD link : CVE-2015-8856
Mitre link : CVE-2015-8856
CVE.ORG link : CVE-2015-8856
JSON object : View
Products Affected
openjsf
- serve-index
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')