RSS   Vulnerabilities for 'Etherpad'   RSS

2021-04-28
 
CVE-2020-22781

CWE-89
 

 
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).

 
 
CVE-2020-22782

NVD-CWE-noinfo
 

 
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance.

 
 
CVE-2020-22785

CWE-770
 

 
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check.

 
 
CVE-2020-22783

CWE-312
 

 
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.

 
2020-02-13
 
CVE-2015-3309

CWE-22
 

 
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.

 
2018-04-07
 
CVE-2018-9326

CWE-noinfo
 

 
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.

 
2018-02-08
 
CVE-2018-6835

CWE-20
 

 
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.

 
2018-01-12
 
CVE-2015-2298

CWE-200
 

 
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.

 
2017-09-07
 
CVE-2015-4085

 

 
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.

 
2017-07-07
 
CVE-2015-3297

 

 
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.

 


Copyright 2021, cxsecurity.com

 

Back to Top