Design/Logic Flaw

In Etherpad UeberDB 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names...

Buffer overflow

Etherpad 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check...

Code injection

Etherpad 1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad...

CVE-2020-22781

In Etherpad 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service crash the instance...

CVE-2020-22781

The CVE-2020-22781 vulnerability affects Etherpad Lite versions older than 1.8.3. A specially crafted URI can trigger an unhandled exception in Etherpad’s cache mechanism, leading to a denial of service (instance crash). This conclusion is supported by multiple sources in both CVE records and ext...

CVE-2020-22782

CVE-2020-22782 affects Etherpad-Lite

CVE-2020-22782

Etherpad 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance...

CVE-2020-22783

CVE-2020-22783 affects Etherpad/Lite prior to 1.8.3. The root issue is insecure storage of passwords in the database and in log files across all supported database backends. This leads to potential exposure of user credentials. The CVE entries consistently describe this as a vulnerability in vers...

CVE-2020-22783

Etherpad 1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad...

CVE-2020-22784

Affected software : Etherpad UeberDB (pre-0.4.4). Root cause : MySQL omits trailing spaces on CHAR/VARCHAR during comparisons, allowing bypass of key-name access controls via the MySQL connector. Impact : Bypassing access controls for key names in database records. Status : Exploitation details n...

CVE-2020-22785

Etherpad 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check...

CVE-2020-22785

CVE-2020-22785 affects Etherpad-Lite versions prior to 1.8.3 due to a missing lock check, enabling a denial-of-service condition. Aggressively targeting random pad import endpoints with empty data could flatten all pads because of no rate limiting and missing ownership checks. The vulnerability i...

Etherpad-Lite 安全漏洞

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad-Lite versions prior to 1.8.3 that stems from the effects of a missing lock check and can be exploited by an attacker to cause a denial of service...

Etherpad SQL注入漏洞

Etherpad-Lite is a web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad versions prior to 1.8.3, which stems from a specially designed URI that raises an unhandled exception in the caching mechanism and results in a denial of service...

Etherpad 安全漏洞

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in versions of Etherpad prior to 1.8.3 that stems from insecurely storing passwords used by users in the database and log files...

Etherpad 安全漏洞

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad-Lite versions prior to 1.8.3, which can be exploited by attackers to cause a denial of service...

Etherpad UeberDB 安全漏洞

ueberDB is a software application. Turn every database into a simple key-value store. A security vulnerability exists in Etherpad UeberDB versions prior to 0.4.4 that allows bypassing the access control on key name enforcement...

Unauthenticated Remote Command Injection in ep_imageconvert

epimageconvert is a plugin for Etherpad Lite. epimageconvert = 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. Recommendation Update to version 0.0.3 or greater...

GHSA-28GR-86HG-R48W Unauthenticated Remote Command Injection in ep_imageconvert

epimageconvert is a plugin for Etherpad Lite. epimageconvert = 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. Recommendation Update to version 0.0.3 or greater...

Etherpad Path Traversal Vulnerability

Etherpad is the Etherpad Foundation's open source rich text online collaboration software. A path traversal vulnerability exists in the node/utils/Minify.js file in Etherpad versions 1.1.2 through 1.5.4. The vulnerability stems from a failure of a networked system or product to properly filter...