showdoc 数据伪造问题漏洞

showdoc is open source a great tool for IT teams to share documents online. A data forgery issue vulnerability exists in showdoc, which stems from the vulnerability of showdoc to a lost password step attack...

Logic Flaw Vulnerability in ShowDoc

ShowDoc is an online API documentation, technical documentation tool for IT teams. ShowDoc suffers from a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information...

File Upload Vulnerability in Showdoc

ShowDoc an online API documentation, technical documentation tool perfect for IT teams. Showdoc suffers from a file upload vulnerability that can be exploited by an attacker to gain server privileges...

Cross-site Request Forgery (CSRF)

showdoc/showdoc is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in /api/teamMember/save where it is possible to add members to a team through CSRF attacks...

Direct Object Reference

ShowDoc is vulnerable to direct object reference. A remote attacker is able to navigate and retrieve or modify notes belonging to other users by modifying the pageid...

CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

Cross site request forgery (csrf)

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

Code injection

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

CVE-2018-19620

CVE-2018-19620 affects ShowDoc 2.4.1. A remote attacker can edit another user’s notes by navigating with a modified page_id parameter, revealing a broken access-control/ID-based authorization issue. The connected Red Hat and GitHub advisories corroborate unauthenticated or direct object reference...

CVE-2018-19621

ShowDoc 2.4.2 is affected by a cross-site request forgery (CSRF) in the endpoint server/index.php?s=/api/teamMember/save that can be exploited to add members to a team. This vulnerability is documented across multiple sources (CVE-2018-19621, Red Hat CVE entry, GHSA/OSV notices, and CVE records) ...

CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

Information Disclosure

ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...

ShowDoc Information Disclosure Vulnerability

ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. The vulnerability can be exploited by a remote attacker to obtain sensitive information via the modified 'pageid' parameter...

ShowDoc Annotation Editing Vulnerability

ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. A remote attacker can exploit the vulnerability to modify a user's notes with a modified 'pageid' parameter...

ShowDoc Cross-Site Request Forgery Vulnerability

ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...

CVE-2018-19609

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...