Etherpad
Products
1- 11 CVEs
Recent CVEs
11| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-43802 | Cri | 0.65 | 9.9 | 0.02 | Dec 9, 2021 | Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad… | ||
| CVE-2018-9326 | Cri | 0.64 | 9.8 | 0.02 | Apr 7, 2018 | Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. | ||
| CVE-2018-9327 | Hig | 0.53 | 8.1 | 0.02 | Apr 7, 2018 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB). | ||
| CVE-2020-22781 | Hig | 0.49 | 7.5 | 0.01 | Apr 28, 2021 | In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance). | ||
| CVE-2018-9325 | Hig | 0.49 | 7.5 | 0.01 | Apr 7, 2018 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names. | ||
| CVE-2021-34816 | Hig | 0.47 | 7.2 | 0.02 | Jul 21, 2021 | An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source. | ||
| CVE-2015-3309 | Hig | 0.42 | 7.5 | 0.02 | Feb 13, 2020 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is… | ||
| CVE-2015-4085 | Hig | 0.42 | 7.5 | 0.02 | Sep 7, 2017 | Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. | ||
| CVE-2015-3297 | Hig | 0.42 | 7.5 | 0.05 | Jul 7, 2017 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests. | ||
| CVE-2021-34817 | Med | 0.00 | 6.1 | 0.01 | Jul 19, 2021 | A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad. | ||
| CVE-2020-22783 | Med | 0.00 | 6.5 | 0.01 | Apr 28, 2021 | Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad. |
- risk 0.65cvss 9.9epss 0.02
Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad…
- risk 0.64cvss 9.8epss 0.02
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
- risk 0.53cvss 8.1epss 0.02
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
- risk 0.49cvss 7.5epss 0.01
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).
- risk 0.49cvss 7.5epss 0.01
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.
- risk 0.47cvss 7.2epss 0.02
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source.
- risk 0.42cvss 7.5epss 0.02
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is…
- risk 0.42cvss 7.5epss 0.02
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
- risk 0.42cvss 7.5epss 0.05
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
- risk 0.00cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
- risk 0.00cvss 6.5epss 0.01
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.