PatchTheCVEzeit vulnerabilities
Recent CVEs affecting zeit products. 9 tracked.
zeit has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2020-03-30. Highest priority: CVE-2019-5417 (score 57/100).
- CVE-2020-5284 MEDIUM 4.4 UPGRADE Next.js versions before 9.3.2 have a directory traversal vulnerability
- CVE-2019-5417 HIGH 7.5 UPGRADE A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbi
- CVE-2019-5415 HIGH 7.5 DOWNGRADE A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or
- CVE-2018-6184 HIGH 7.5 DOWNGRADE ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.
- CVE-2018-3809 MEDIUM 5.3 DOWNGRADE Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even w
- CVE-2018-3718 MEDIUM 5.3 UPGRADE serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a fi
- CVE-2018-3712 MEDIUM 6.5 UPGRADE serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f
- CVE-2018-18282 MEDIUM 6.1 DOWNGRADE Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
- CVE-2017-16877 HIGH 7.5 UPGRADE ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing att
FAQ
How do I fix zeit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zeit being exploited right now?
None of the tracked zeit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zeit CVE should I patch first?
CVE-2019-5417 currently ranks highest (57/100): A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbi.