CVE-2020-12432

CVE-2020-12432 Collabora CODE Click here 4. 被害者がリンクを開くと、別のサービスにリダイレクトされ、 すべての Cookie とローカルストレージデータが別のネットワークに 送信されます。 動画: https://www.youtube.com/watch?v=tkRnSr6yc0...

Collabora CODE / Collabora Online < 4.2.20 / 5.x < 6.4.16 XSS Vulnerability

Collabora CODE Collabora Online Development Edition and Collabora Online are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Collabora CODE WOPI API Cross-Site Scripting Vulnerability

Collabora CODE is a collaborative office solution from Collabora UK. The product supports online document editing and viewing, etc. WOPI API is one of the WOPI Web Application Open Platform Interface Protocol APIs. A security vulnerability exists in the WOPI API integration in Collabora CODE 4.2....

CVE-2020-12432

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

Improper access control

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

CVE-2020-12432

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

CVE-2020-12432

Summary: CVE-2020-12432 affects Collabora CODE/WOPI integration used by Vereign Collabora CODE up to version 4.2.2. The vulnerability arises from improper restriction of JavaScript delivery to a user’s browser and weak MIME-type access control, enabling cross-site scripting that can steal credent...

CVE-2020-12432: Improper Neutralization of Input During Web Page Generation

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

Collabora CODE / Collabora Online / LibreOffice Online / OxOffice Online / Claro drive Detection (HTTP)

HTTP based detection of Collabora CODE Collabora Online Development Edition, Collabora Online, LibreOffice Online, OxOffice Online, Claro drive and similar other LibreOffice Online based products. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a reference...