showdoc vulnerabilities and fixes

Recent CVEs affecting showdoc, with upgrade or downgrade steps. 36 tracked.

showdoc has 36 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 33. Most recent: 2022-03-22. Highest priority: CVE-2021-36440 (score 67/100).

• CVE-2022-1034 HIGH 7.2 UPGRADE There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc p
• CVE-2022-0967 MEDIUM 5.4 UPGRADE Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to
• CVE-2022-0966 MEDIUM 5.4 UPGRADE Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
• CVE-2022-0965 MEDIUM 5.4 UPGRADE Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0964 MEDIUM 5.4 UPGRADE Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0962 MEDIUM 5.4 UPGRADE Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0960 MEDIUM 5.4 UPGRADE Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0957 MEDIUM 5.4 UPGRADE Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0956 MEDIUM 5.4 UPGRADE Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
• CVE-2022-0951 MEDIUM 6.1 UPGRADE File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior
• CVE-2022-0950 MEDIUM 5.4 UPGRADE Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0946 MEDIUM 5.4 UPGRADE Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.
• CVE-2022-0945 MEDIUM 5.4 UPGRADE Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2
• CVE-2022-0942 MEDIUM 5.4 UPGRADE Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0941 MEDIUM 5.4 UPGRADE Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
• CVE-2022-0940 MEDIUM 5.4 UPGRADE Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
• CVE-2022-0938 MEDIUM 5.4 UPGRADE Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
• CVE-2022-0937 MEDIUM 5.4 UPGRADE Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
• CVE-2022-0880 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
• CVE-2022-0409 HIGH 7.8 UPGRADE Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
• CVE-2022-0362 CRITICAL 9.8 UPGRADE SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
• CVE-2022-0079 MEDIUM 5.3 UPGRADE showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
• CVE-2021-4172 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
• CVE-2021-4168 HIGH 8.8 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-4017 HIGH 8.8 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-4000 MEDIUM 6.1 MITIGATE showdoc is vulnerable to URL Redirection to Untrusted Site
• CVE-2021-41745 CRITICAL 9.8 DOWNGRADE ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server per
• CVE-2021-3993 MEDIUM 6.5 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3990 MEDIUM 6.5 UPGRADE showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CVE-2021-3989 MEDIUM 6.1 UPGRADE showdoc is vulnerable to URL Redirection to Untrusted Site
• CVE-2021-3776 MEDIUM 5.4 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3775 MEDIUM 5.4 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3683 MEDIUM 6.5 UPGRADE showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3680 MEDIUM 4.9 UPGRADE showdoc is vulnerable to Missing Cryptographic Step
• CVE-2021-3678 MEDIUM 5.9 UPGRADE showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CVE-2021-36440 CRITICAL 9.8 DOWNGRADE Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url

FAQ

How do I fix showdoc vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is showdoc being exploited right now?

None of the tracked showdoc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which showdoc CVE should I patch first?

CVE-2021-36440 currently ranks highest (67/100): Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url.

RSS feed for showdoc · ← Back to latest CVEs