Robert Helmer

2 exploits Active since Feb 2018

CVE-2018-6834 WRITEUP MEDIUM WRITEUP

Etherpad Lite < 1.6.3 - Cross-Site Scripting via window.location.href

static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.

CVSS 6.1

View Code

CVE-2018-6835 WRITEUP CRITICAL WRITEUP

Etherpad Lite < 1.6.3 - Unauthenticated Access Restriction Bypass via JSONP Mishandling

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.

CVSS 9.8

View Code