Hostme v2

An unauthenticated attacker can craft script-bearing input that reaches an unsafe browser-side DOM operation. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 7.0.

An unauthenticated attacker can supply untrusted serialized input that is converted into application objects. The export identifies object injection but does not disclose the deserialization function, input format or a usable gadget chain; code execution is not independently established by this sparse record. The endpoint, action and parameter are not disclosed. The CNA vector records high confidentiality impact, high integrity impact, high availability impact. Affected versions: at most 7.0.

Hostme v2 is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.