242 matches found
CVE-2019-18209: Improper Neutralization of Input During Web Page Generation
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
Etherpad Lite Access Control Bypass Vulnerability
Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A security vulnerability exists in the webaccess.js file in Etherpad Lite versions prior to 1.6.4. A remote attacker can exploit this vulnerability by sending a specially crafted request to...
CVE-2018-9845
Etherpad Lite before 1.6.4 is exploitable for admin access...
Design/Logic Flaw
Etherpad Lite before 1.6.4 is exploitable for admin access...
CVE-2018-9845
Etherpad Lite before 1.6.4 is exploitable for admin access...
CVE-2018-9845
Etherpad Lite before version 1.6.4 is vulnerable to an admin authentication bypass that allows an attacker to gain admin access. The issue is documented across multiple sources (NVD, Nuclei template, SUSE, CNVD, OSV, etc.) with the root cause described as an admin-privilege bypass affecting Ether...
CVE-2018-9845
Etherpad Lite before 1.6.4 is exploitable for admin access...
CVE-2018-9845: Improper Handling of Case Sensitivity
Etherpad Lite before 1.6.4 is exploitable for admin access...
Etherpad Arbitrary Code Execution Vulnerability
Etherpad is a Web-based online document collaboration tool. Multiple users can write a text document simultaneously via Etherpad and see real-time edits from all participants. An arbitrary code execution vulnerability exists in Etherpad 1.5.x and 1.6.x before 1.6.4. An attacker can exploit this...
Etherpad Arbitrary Code Execution Vulnerability (CNVD-2018-08480)
Etherpad is a Web-based online document collaboration tool. Multiple users can write a text document simultaneously via Etherpad and see real-time edits from all participants. An arbitrary code execution vulnerability exists in Etherpad 1.6.3. An attacker can exploit this vulnerability to execute...
CVE-2018-9325
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names...
CVE-2018-9326
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code...
CVE-2018-9326
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code...
CVE-2018-9325
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names...
CVE-2018-9327
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database DirtyDB, CouchDB, MongoDB, or RethinkDB...
CVE-2018-9327
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database DirtyDB, CouchDB, MongoDB, or RethinkDB...
CVE-2018-9326
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code...
Design/Logic Flaw
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database DirtyDB, CouchDB, MongoDB, or RethinkDB...