Published: 08/10/2014 Updated: 08/09/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

visionmedia send prior to 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote malicious users to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 21
fedoraproject fedora 20
fedoraproject fedora 19
apple xcode 7.0
joyent node.js
joyent node.js 0.8.2
joyent node.js 0.8.1
joyent node.js 0.8.0

visionmedia send before 084 for Nodejs uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory ...

Node.js middleware for creating applications that find VIVO profiles relevant to content in the user's browser.

searchlight Nodejs middleware for creating applications that find VIVO profiles relevant to content in the user's browser ##About To learn more about searchlight and how it's been used - check out our about page ##Documentation ###Installation Install nodejs version 0126 $ git clone gitgithubcom/ragle/searchlight $ cd searchlight $ npm install ###Quic

CWE-22 https://github.com/visionmedia/send/pull/59 http://www.openwall.com/lists/oss-security/2014/09/24/1 http://www.securityfocus.com/bid/70100 http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139415.html http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html https://nodesecurity.io/advisories/send-directory-traversal https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a https://bugzilla.redhat.com/show_bug.cgi?id=1146063 http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html http://www.openwall.com/lists/oss-security/2014/09/30/10 http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html https://support.apple.com/HT205217 http://www-01.ibm.com/support/docview.wss?uid=swg21687263 http://secunia.com/advisories/62170 https://exchange.xforce.ibmcloud.com/vulnerabilities/96727 https://nvd.nist.gov https://github.com/ragle/searchlight https://access.redhat.com/security/cve/cve-2014-6394

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-6394

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect