Vendor
vapor
11 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
High 7.5
DoS Vulnerability in URLEncodedFormDecoder in Vapor
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -…
-
High 7.5
Integer Overflow in Vapor's HTTP Range Request
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, d…
-
High 7.4
LeafKit allows XSS with untrusted user input
Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any string…
-
High 7.5
Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up…
-
High 8.5
Arbitrary file read un Vapor
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.