PT-2019-15277

Name of the Vulnerable Software and Affected Versions Etherpad-Lite version 1.7.5 Description The issue arises in the templates/pad.html file of Etherpad-Lite when the browser does not properly encode the path of the URL, leading to a cross-site scripting XSS vulnerability. This has been...

CVE-2019-18209: Improper Neutralization of Input During Web Page Generation

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

Etherpad Lite Access Control Bypass Vulnerability

Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A security vulnerability exists in the webaccess.js file in Etherpad Lite versions prior to 1.6.4. A remote attacker can exploit this vulnerability by sending a specially crafted request to...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

Design/Logic Flaw

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845

Etherpad Lite before version 1.6.4 is vulnerable to an admin authentication bypass that allows an attacker to gain admin access. The issue is documented across multiple sources (NVD, Nuclei template, SUSE, CNVD, OSV, etc.) with the root cause described as an admin-privilege bypass affecting Ether...

CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

CVE-2018-9845: Improper Handling of Case Sensitivity

Etherpad Lite before 1.6.4 is exploitable for admin access...

PT-2018-19069

Name of the Vulnerable Software and Affected Versions Etherpad Lite versions prior to 1.6.4 Description The issue allows for exploitation to gain admin access. Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue...

Etherpad Lite Cross-Site Scripting Vulnerability

Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A cross-site scripting vulnerability exists in the static/js/padutils.js file in Etherpad Lite versions prior to 1.6.3. A remote attacker can use window.location.href to inject arbitrary Web...

CVE-2018-6834

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

CVE-2018-6834

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

Design/Logic Flaw

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

Design/Logic Flaw

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

CVE-2018-6834

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...