Skip to content

Product

debian/node-send vulnerabilities

3 published CVES affecting debian/node-send, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
1
Unscored
0
CISA KEV
0

Latest debian/node-send CVEs

Newest publication first

  1. CVE-2024-43799 send vulnerable to template injection that can lead to XSS

    Published
    LowCVSS 2.3

    Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue...

  2. CVE-2014-6394 Directory Traversal in send

    Published
    HighCVSS 7.5 EPSS 4.3%

    visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

  3. CVE-2015-8859 Root Path Disclosure in send

    MediumCVSS 5.3

    Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem. Recommendation Update to version 0.11.1 or later.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.