596 matches found
CVE-2018-19621
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...
Information Disclosure
ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...
ShowDoc Cross-Site Request Forgery Vulnerability
ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...
ShowDoc Annotation Editing Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. A remote attacker can exploit the vulnerability to modify a user's notes with a modified 'pageid' parameter...
CVE-2018-19620: Direct Request
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
CVE-2018-19621: Cross-Site Request Forgery (CSRF)
server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...
PT-2018-15022
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue allows remote attackers to edit other users' notes by navigating with a modified page id. This can be achieved by manipulating the page id to access and modify notes belonging to other users...
ShowDoc Information Disclosure Vulnerability
ShowDoc is an online document sharing tool. A security vulnerability exists in ShowDoc version 2.4.1. The vulnerability can be exploited by a remote attacker to obtain sensitive information via the modified 'pageid' parameter...
PT-2018-15023
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Code injection
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
CVE-2018-19609
CVE-2018-19609 affects ShowDoc 2.4.1. The issue lets remote attackers disclose sensitive data by supplying a modified page_id, enabling reads of note content or discovery of usernames in JSON data at a different URL. Publicly documented details across multiple sources confirm the vulnerability is...
CVE-2018-19609
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
PT-2018-15020
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue allows remote attackers to obtain sensitive information by navigating with a modified page id. This can be demonstrated by reading note content or discovering a username in the JSON data at a diff UR...
CVE-2018-19609: Exposure of Sensitive Information to an Unauthorized Actor
ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified pageid, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL...
Cross-site Scripting (XSS)
showdoc/showdoc is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the value of lang parameter, allowing XSS attacks...