CVE-2021-36440

CVE-2021-36440 affects ShowDoc v2.9.5 and is an Unrestricted File Upload vulnerability. The reports consistently state that an attacker can upload a file through the file_url parameter in AdminUpdateController.class.php to execute arbitrary code remotely. Multiple sources (NVD, Red Hat advisory, ...

CVE-2021-36440

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'fileurl' parameter in the component AdminUpdateController.class.php'...

ShowDoc 代码问题漏洞

ShowDoc is an online API documentation, technical documentation tool ideal for IT teams. showDoc version 2.9.5 is vulnerable to file upload. A remote attacker can exploit this vulnerability to execute arbitrary code via the fileurl parameter in AdminUpdateController.class.php...

Cross-Site Request Forgery (CSRF) in star7th/showdoc

✍️ Description With CSRF vulnerability Attacker able to add any member to for any item if users visit attacker website. We can bypass the CSRF Protection if we put our payload on a iframe or a html file and send them to victim as after that the Origin header will be set to null and we can bypass...

Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

GHSA-J85Q-WHC9-G4P9 Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

Insecure Encryption

showdoc/showdoc has insecure encryption. The vulnerability exists due to a hardcoded salt in its user password hash function...

Inadequate Encryption Strength in showdoc

showdoc makes use of a hardcoded salt in its user password hash function...

GHSA-8VH3-29MR-M9XG Inadequate Encryption Strength in showdoc

showdoc makes use of a hardcoded salt in its user password hash function...

CVE-2021-3678

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3678

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3678

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

Code injection

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3680

showdoc is vulnerable to Missing Cryptographic Step...

Design/Logic Flaw

showdoc is vulnerable to Missing Cryptographic Step...

CVE-2021-3678 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3678

CVE-2021-3678 affects the showdoc project (star7th/showdoc) with a cryptographically weak PRNG. Connected sources (GHSA, Red Hat, OSV, CVE lists) consistently describe usage of insecure randomness (e.g., MD5-based/low-entropy paths, time/rand reliance) as the root cause. Impact details in the ref...

CVE-2021-3680 Missing Cryptographic Step in star7th/showdoc

showdoc is vulnerable to Missing Cryptographic Step...

CVE-2021-3680

CVE-2021-3680 relates to showdoc and centers on a missing cryptographic step due to a hardcoded salt in the user password hash function. Documents from GHSA-8VH3-29MR-M9XG and PT-2021-21367 confirm this flaw and describe the use of a fixed salt, implying weaknesses in password hashing. No concret...

showdoc 安全特征问题漏洞

showdoc is an open source tool ideal for IT teams to share documents online. showdoc in the security features problematic vulnerability , the vulnerability stems from the lack of a limit on the number of client logins and thus vulnerable to password weak pseudo-random number generator PRNG attack...