145 matches found
EUVD-2025-201504
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...
CVE-2025-66629 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...
CVE-2025-66629
HedgeDoc versions prior to 1.10.4 are affected by missing CSRF protection in OAuth2 endpoints for social logins (Google, GitHub, GitLab, Facebook, Dropbox) due to not sending/verifying a state parameter. This could allow attackers to hijack user authentication sessions. The issue is fixed in 1.10...
CVE-2025-66629 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...
CVE-2025-66629 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...
PT-2025-49322
Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.10.4 Description HedgeDoc is a real-time, collaborative, markdown notes application. Certain OAuth2 endpoints used for social login providers—including Google, GitHub, GitLab, Facebook, and Dropbox—did not include...
HedgeDoc 跨站请求伪造漏洞
HedgeDoc is a Javascript-based real-time editing and sharing platform for Markdown documents from the HedgeDoc team. A cross-site request forgery vulnerability exists in HedgeDoc versions prior to 1.10.4, which stems from a lack of CSRF protection in the OAuth2 endpoint and could lead to cross-si...
EUVD-2020-18855
Malware in sbrugna...
EUVD-2021-16099
Malware in sbrugna...
EUVD-2021-25572
Malware in sbrugna...
EUVD-2021-16082
Malware in sbrugna...
EUVD-2021-16083
Malware in sbrugna...
EUVD-2024-41431
Malicious code in bioql PyPI...
EUVD-2022-29622
Malicious code in bioql PyPI...
EUVD-2025-10682
Malicious code in bioql PyPI...
EUVD-2021-8640
Malicious code in bioql PyPI...
EUVD-2023-42303
Malicious code in bioql PyPI...
CVE-2024-45308
HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by t...
CVE-2022-24837
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...
CVE-2021-29474
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker can read arbitrary .md files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can t...