242 matches found
GHSA-28GR-86HG-R48W Unauthenticated Remote Command Injection in ep_imageconvert
epimageconvert is a plugin for Etherpad Lite. epimageconvert = 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. Recommendation Update to version 0.0.3 or greater...
Unauthenticated Remote Command Injection in ep_imageconvert
epimageconvert is a plugin for Etherpad Lite. epimageconvert = 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. Recommendation Update to version 0.0.3 or greater...
Etherpad Path Traversal Vulnerability
Etherpad is the Etherpad Foundation's open source rich text online collaboration software. A path traversal vulnerability exists in the node/utils/Minify.js file in Etherpad versions 1.1.2 through 1.5.4. The vulnerability stems from a failure of a networked system or product to properly filter...
CVE-2015-3309
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...
CVE-2015-3309
The CVE-2015-3309 entry concerns Etherpad’s Minify.js (node/utils/Minify.js) with a directory traversal vulnerability in Etherpad versions 1.1.2 through 1.5.4. The root cause is an incomplete fix to CVE-2015-3297, allowing an attacker to read arbitrary files via a .. sequence in the path paramete...
CVE-2015-3309
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...
CVE-2015-3309: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...
CVE-2013-7380
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...
CVE-2013-7380
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability Authentication is not required for remote exploitation...
Command injection
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...
UBUNTU-CVE-2013-7380
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability Authentication is not required for remote exploitation...
CVE-2013-7380
The Etherpad Lite ep_imageconvert Plugin for Etherpad Lite is affected by a Remote Command Injection vulnerability. Affected: ep_imageconvert
CVE-2013-7380
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...
CVE-2013-7380: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...
Etherpad-Lite Cross-Site Scripting Vulnerability
Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A cross-site scripting vulnerability exists in the templates/pad.html page in Etherpad-Lite version 1.7.5, which stems from a lack of proper validation of client-side data in the WEB application and can be...
CVE-2019-18209
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
CVE-2019-18209
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
Default credentials
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
CVE-2019-18209
CVE-2019-18209 affects Etherpad-Lite 1.7.5, with XSS in templates/pad.html when the browser does not encode the URL path (demonstrated in Internet Explorer). The root cause is lack of proper validation/encoding of client-side data in that page. Public disclosures in multiple feeds confirm the iss...