copyparty

vulnerable: 0.10.0 ... 1.8.1 (226 versions)

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands …

vulnerable: 0.10.0 ... 1.8.6 (230 versions)

copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing fi…

vulnerable: 0.10.0 ... 1.9.9 (311 versions)

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging…

vulnerable: 0.10.0 ... 1.9.9 (326 versions)

copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music f…

vulnerable: 0.10.0 ... 1.9.9 (328 versions)

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which refl…

vulnerable: 0.10.0 ... 1.9.9 (330 versions)

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks t…

vulnerable: 0.10.0 ... 1.9.9 (340 versions)

Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access t…

vulnerable: 0.10.0 ... 1.9.9 (368 versions)

Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access There was a missing permission-check in the shares feature (the `shr` global-option). This vulnerability only applies in the following scenario: * The …

vulnerable: 0.10.0 ... 1.9.9 (368 versions)

Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html` If an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename `.prologue.html…