596 matches found
CVE-2018-19620
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
Information Disclosure
ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...
ShowDoc Annotation Editing Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. A remote attacker can exploit the vulnerability to modify a user's notes with a modified 'pageid' parameter...
ShowDoc Cross-Site Request Forgery Vulnerability
ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...
PT-2018-15023
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...
PT-2018-15022
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue allows remote attackers to edit other users' notes by navigating with a modified page id. This can be achieved by manipulating the page id to access and modify notes belonging to other users...
CVE-2018-19620: Direct Request
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
CVE-2018-19621: Cross-Site Request Forgery (CSRF)
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...
ShowDoc Information Disclosure Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. The vulnerability can be exploited by a remote attacker to obtain sensitive information via the modified 'pageid' parameter...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Code injection
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
CVE-2018-19609 affects ShowDoc 2.4.1. The issue lets remote attackers disclose sensitive data by supplying a modified page_id, enabling reads of note content or discovery of usernames in JSON data at a different URL. Publicly documented details across multiple sources confirm the vulnerability is...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
PT-2018-15020
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue allows remote attackers to obtain sensitive information by navigating with a modified page id. This can be demonstrated by reading note content or discovering a username in the JSON data at a diff UR...
CVE-2018-19609: Exposure of Sensitive Information to an Unauthorized Actor
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Cross-site Scripting (XSS)
showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of lang parameter, allowing XSS attacks...