288 matches found
CVE-2018-9325
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names...
CVE-2018-9327: Improper Input Validation
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database DirtyDB, CouchDB, MongoDB, or RethinkDB...
PT-2018-18984
Name of the Vulnerable Software and Affected Versions Etherpad versions 1.5.x through 1.6.3 Description The issue allows an attacker to execute arbitrary code on the server, but only if the instance is configured to use a document database such as DirtyDB, CouchDB, MongoDB, or RethinkDB...
CVE-2018-9326: Undefined Security Weakness
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code...
PT-2018-18983
Name of the Vulnerable Software and Affected Versions Etherpad version 1.6.3 Description The issue allows an attacker to execute arbitrary code. Recommendations For Etherpad version 1.6.3, update to version 1.6.4 or later to resolve the issue...
PT-2018-18982
Name of the Vulnerable Software and Affected Versions Etherpad versions 1.5.x through 1.6.3 Description The issue allows an attacker to export all existing pads of an instance without knowledge of pad names. Recommendations For versions 1.5.x through 1.6.3, update to version 1.6.4 or later to...
CVE-2018-9325: Exposure of Sensitive Information to an Unauthorized Actor
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names...
Etherpad Lite Cross-Site Scripting Vulnerability
Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A cross-site scripting vulnerability exists in the static/js/padutils.js file in Etherpad Lite versions prior to 1.6.3. A remote attacker can use window.location.href to inject arbitrary Web...
Etherpad Lite Access Restriction Bypass Vulnerability
Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A security vulnerability exists in the node/hooks/express/apicalls.js file in versions of Etherpad Lite prior to 1.6.3, which stems from the program failing to handle JSONP correctly.An attack...
CVE-2018-6835
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...
CVE-2018-6834
static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...
CVE-2018-6835
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...
CVE-2018-6834
static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...
Design/Logic Flaw
static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...
Design/Logic Flaw
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...
CVE-2018-6834
static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...
CVE-2018-6835
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...
CVE-2018-6834
static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...
CVE-2018-6834
Consolidated details show Etherpad Lite before v1.6.3 is vulnerable to Cross‑Site Scripting via static/js/pad_utils.js (pad_utils.js) triggered by window.location.href. The issue is documented across multiple sources (NVD, CNVD, OSV, SUSE, CNVD variants) with the affected component identified as ...