CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

Cross site request forgery (csrf)

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

CVE-2018-19621

ShowDoc 2.4.2 is affected by a cross-site request forgery (CSRF) in the endpoint server/index.php?s=/api/teamMember/save that can be exploited to add members to a team. This vulnerability is documented across multiple sources (CVE-2018-19621, Red Hat CVE entry, GHSA/OSV notices, and CVE records) ...

CVE-2018-19621

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

CVE-2018-19620

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

CVE-2018-19620

CVE-2018-19620 affects ShowDoc 2.4.1. A remote attacker can edit another user’s notes by navigating with a modified page_id parameter, revealing a broken access-control/ID-based authorization issue. The connected Red Hat and GitHub advisories corroborate unauthenticated or direct object reference...

Information Disclosure

ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...

ShowDoc Cross-Site Request Forgery Vulnerability

ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...

CVE-2018-19621: Cross-Site Request Forgery (CSRF)

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

ShowDoc Annotation Editing Vulnerability

ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. A remote attacker can exploit the vulnerability to modify a user's notes with a modified 'pageid' parameter...

ShowDoc Information Disclosure Vulnerability

ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. The vulnerability can be exploited by a remote attacker to obtain sensitive information via the modified 'pageid' parameter...

CVE-2018-19620: Direct Request

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...

CVE-2018-19609

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

CVE-2018-19609

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

Code injection

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

CVE-2018-19609

CVE-2018-19609 affects ShowDoc 2.4.1. The issue lets remote attackers disclose sensitive data by supplying a modified page_id, enabling reads of note content or discovery of usernames in JSON data at a different URL. Publicly documented details across multiple sources confirm the vulnerability is...

CVE-2018-19609

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

CVE-2018-19609: Exposure of Sensitive Information to an Unauthorized Actor

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...

Cross-site Scripting (XSS)

showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of lang parameter, allowing XSS attacks...