Jacksongl

Name of the Vulnerable Software and Affected Versions: gaoxiaotingtingting (affected versions not specified) Description: The issue concerns a directory traversal vulnerability in an HTTP server, allowing an attacker to access the filesystem by manipulating the URL with "../". This can lead to the disclosure of private files on the vulnerable system. A malicious actor can exploit this vulnerability by making a specially crafted request, such as a GET request to access files outside the intended directory root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Name of the Vulnerable Software and Affected Versions: hostr versions 2.3.5 and earlier Description: There is a directory traversal issue that allows an attacker to read files outside the current directory by sending `../` in the URL path for GET requests. This enables attackers to access files they should not be able to access. Recommendations: For hostr versions 2.3.5 and earlier, upgrade to version 2.3.6 or later.

Name of the Vulnerable Software and Affected Versions: f2e-server versions 1.12.11 and earlier Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability. This is achieved by placing "../" in the URL, enabling access to files outside the intended directory root, which may result in the disclosure of private files on the vulnerable system. For example, a malicious actor can send a GET request to `/../../../../../../../../../../etc/passwd` to access sensitive files. Recommendations: Update to version 1.12.12 or later. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.