CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 19/07/2021 |
| CVE-2020-22785 | ALTO7.5 | Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check. | 28/04/2021 |
| CVE-2020-22784 | ALTO7.5 | In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names. | 28/04/2021 |
| CVE-2020-22783 | MEDIO6.5 | Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad. | 28/04/2021 |
| CVE-2020-22782 | ALTO7.5 | Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance. | 28/04/2021 |
| CVE-2020-22781 | ALTO7.5 | In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance). | 28/04/2021 |
| CVE-2015-3309 | ALTO7.5 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297. | 13/02/2020 |
| CVE-2019-18209 | MEDIO6.1 | templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer. | 19/10/2019 |
| CVE-2018-9845 | CRITICO9.8 | Etherpad Lite before 1.6.4 is exploitable for admin access. | 29/04/2018 |
| CVE-2018-9327 | ALTO8.1 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB). | 07/04/2018 |
| CVE-2018-9326 | CRITICO9.8 | Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. | 07/04/2018 |
| CVE-2018-9325 | ALTO7.5 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names. | 07/04/2018 |
| CVE-2018-6835 | CRITICO9.8 | node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions. | 08/02/2018 |
| CVE-2018-6834 | MEDIO6.1 | static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href. | 08/02/2018 |
| CVE-2015-2298 | ALTO7.5 | node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID. | 12/01/2018 |
| CVE-2015-4085 | ALTO7.5 | Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. | 07/09/2017 |
| CVE-2015-3297 | ALTO7.5 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests. | 07/07/2017 |