Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-28GR-86HG-R48W

    Vulnerability from github – Published: 2020-08-31 22:43 – Updated: 2021-09-23 19:27
    VLAI
    Summary
    Unauthenticated Remote Command Injection in ep_imageconvert
    Details

    ep_imageconvert is a plugin for Etherpad Lite. ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.

    Authentication is not required for remote exploitation.

    Recommendation

    Update to version 0.0.3 or greater.

    Severity
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "ep_imageconvert"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-3364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:07:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert \u003c= 0.0.2 is vulnerable to remote command injection.\n\nAuthentication is not required for remote exploitation.\n\n\n## Recommendation\n\nUpdate to version 0.0.3 or greater.",
  "id": "GHSA-28gr-86hg-r48w",
  "modified": "2021-09-23T19:27:57Z",
  "published": "2020-08-31T22:43:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3364"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redhog/ep_imageconvert/pull/5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redhog/ep_imageconvert"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/npm:ep_imageconvert:20130506"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unauthenticated Remote Command Injection in ep_imageconvert"
}

    GSD-2013-3364

    Vulnerability from gsd - Updated: 2023-12-13 01:22
    Details
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
    Aliases
    Aliases
    CVE-2013-3364
    To clipboard 

    {
  "GSD": {
    "alias": "CVE-2013-3364",
    "id": "GSD-2013-3364"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-3364"
      ],
      "id": "GSD-2013-3364",
      "modified": "2023-12-13T01:22:22.917962Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2013-3364",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.0.2",
          "affected_versions": "All versions up to 0.0.2",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-09-23",
          "description": "ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert \u003c= 0.0.2 is vulnerable to remote command injection.\n\nAuthentication is not required for remote exploitation.\n\n\n## Recommendation\n\nUpdate to version 0.0.3 or greater.",
          "fixed_versions": [
            "0.0.3"
          ],
          "identifier": "GMS-2020-714",
          "identifiers": [
            "GHSA-28gr-86hg-r48w",
            "GMS-2020-714",
            "CVE-2013-3364"
          ],
          "not_impacted": "All versions after 0.0.2",
          "package_slug": "npm/ep_imageconvert",
          "pubdate": "2020-08-31",
          "solution": "Upgrade to version 0.0.3 or above.",
          "title": "Unauthenticated Remote Command Injection in ep_imageconvert",
          "urls": [
            "https://github.com/redhog/ep_imageconvert/pull/5",
            "https://www.npmjs.com/advisories/7",
            "https://nvd.nist.gov/vuln/detail/CVE-2013-3364",
            "https://snyk.io/vuln/npm:ep_imageconvert:20130506",
            "https://github.com/advisories/GHSA-28gr-86hg-r48w"
          ],
          "uuid": "5750ef1f-04c7-4b94-813e-3b98e2342eac"
        }
      ]
    }
  }
}