5 results · Feed
-
Medium —
Path Traversal in public
All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. ## Recommendation No fix is currently available. Do not use `public` in product…
-
Low —
Cross-Site Scripting in public
All versions of `public` are vulnerable to stored cross-site scripting (XSS). ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
-
Medium 6.1
Tnantoka/public XSS Vulnerability
A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
-
Medium 6.1
Cross-Site Scripting in public
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
-
High 7.5
Path Traversal in public
public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.