CVE-2018-6834

Consolidated details show Etherpad Lite before v1.6.3 is vulnerable to Cross‑Site Scripting via static/js/pad_utils.js (pad_utils.js) triggered by window.location.href. The issue is documented across multiple sources (NVD, CNVD, OSV, SUSE, CNVD variants) with the affected component identified as ...

CVE-2018-6835

Etherpad Lite before v1.6.3 contains a vulnerability in node/hooks/express/apicalls.js where JSONP is mishandled, allowing remote attackers to bypass intended access restrictions. The issue is tied to CVE-2018-6835. Affected software/version details from connected sources indicate the fix was rel...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

CVE-2018-6834: Improper Neutralization of Input During Web Page Generation

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

PT-2018-17767

Name of the Vulnerable Software and Affected Versions Etherpad Lite versions prior to 1.6.3 Description The issue is related to a security problem in the static/js/pad utils.js file. It allows for XSS via the window.location.href. Recommendations For versions prior to 1.6.3, update to version 1.6...

PT-2018-17768

Name of the Vulnerable Software and Affected Versions Etherpad Lite versions prior to 1.6.3 Description The issue is related to the mishandling of JSONP in the node/hooks/express/apicalls.js file, which allows remote attackers to bypass intended access restrictions. Recommendations For versions...

CVE-2018-6835: Improper Input Validation

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

Unauthenticated Remote Command Injection

Overview epimageconvert is a plugin for Etherpad Lite. epimageconvert = 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. Recommendation Update to version 0.0.3 or greater. References - PR 5 - GitHub Advisory...

Etherpad Lite 'utils/Minify.js' Directory Traversal Vulnerability

Etherpad is software for rich text collaboration in a multiplayer environment. A directory traversal vulnerability exists in Etherpad Lite 'utils/Minify.js'. This allows remote attackers to exploit the vulnerability by using path traversal characters ". . /" to access or read arbitrary files to...