@vitejs/plugin-react vulnerabilities (TuxCare)
19 vulnerabilities.
-
@vitejs/plugin-reactTuxCare NTLMv2 hash disclosure via UNC path handling on Windows 5.5 Medium -
@vitejs/plugin-reactTuxCare Vite: `server.fs.deny` bypass on Windows alternate paths 8.2 High -
@vitejs/plugin-reactTuxCare launch-editor vulnerable to command injection via the crafted request on Windows 7.5 High -
@vitejs/plugin-reactTuxCare Vite has a Path Traversal in Optimized Deps `.map` Handling 6.3 Medium -
@vitejs/plugin-reactTuxCare Vite has a `server.fs.deny` bypass with queries 8.2 High -
@vitejs/plugin-reactTuxCare Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket 8.2 High -
@vitejs/plugin-reactTuxCare vite allows server.fs.deny bypass via backslash on Windows 6.0 Medium -
@vitejs/plugin-reactTuxCare Vite's `server.fs` settings were not applied to HTML files 2.3 Low -
@vitejs/plugin-reactTuxCare Vite middleware may serve files starting with the same name with the public directory 2.3 Low -
@vitejs/plugin-reactTuxCare Vite's server.fs.deny bypassed with /. for files under project root 6.0 Medium -
@vitejs/plugin-reactTuxCare Vite has an `server.fs.deny` bypass with an invalid `request-target` 6.0 Medium -
@vitejs/plugin-reactTuxCare Vite allows server.fs.deny to be bypassed with .svg or relative paths 5.3 Medium -
@vitejs/plugin-reactTuxCare Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query 5.3 Medium -
@vitejs/plugin-reactTuxCare Vite bypasses server.fs.deny when using `?raw??` 5.3 Medium -
@vitejs/plugin-reactTuxCare Vite allows any websites to send any requests to the development server and read the response 6.5 Medium -
@vitejs/plugin-reactTuxCare DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite 6.4 Medium -
@vitejs/plugin-reactTuxCare server.fs.deny bypassed when using ?import&raw in vite 4.8 Medium -
@vitejs/plugin-reactTuxCare Vite's `server.fs.deny` did not deny requests for patterns with directories 5.9 Medium -
@vitejs/plugin-reactTuxCare Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem 7.5 High