167 matches found
CVE-2020-11534
ONLYOFFICE Document Server 5.5.0 is affected by CVE-2020-11534. The issue arises from NSFileDownloader handling crafted .docx input, allowing parameters to be passed to a binary (e.g., curl or wget) and enabling remote code execution on the server. The available sources describe the impact as rem...
CVE-2020-11535
ONLYOFFICE Document Server 5.5.0 is affected by CVE-2020-11535. A crafted malicious .docx file enables XML injection that can inject parameters into the x2t binary, allowing rewriting of x2t and/or libxcb.so.1 and enabling code execution on the server. The connected documents confirm the affected...
CVE-2020-11535
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server...
CVE-2020-11536
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...
CVE-2020-11536
CVE-2020-11536 affects ONLYOFFICE Document Server 5.5.0. A maliciously crafted .docx can exploit the unzip function to rewrite a binary and remotely execute code on the server. The connected docs confirm the impact as remote code execution via crafted documents, but do not provide a vendor patch ...
CVE-2020-11537
ONLYOFFICE Document Server 5.5.0 is affected by a SQL Injection vulnerability that allows an attacker to execute arbitrary SQL queries via the DocID parameter of the Websocket API. Root cause: improper handling of input in the Websocket API leading to SQL injection. Impact: high/severe confidenti...
CVE-2020-11537
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
Adobe Document Server 6.0 Extensions ads-readerext actionID Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17500/info Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to: - perform cross-site scripting attacks -...
Adobe Document Server 6.0 Extensions AlterCast op Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17500/info Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to: - perform cross-site scripting attacks -...
AXIS 70U Network Document Server Privilege Escalation/XSS
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS http://dsecrg.com/pages/vul/show.php?id=60 Application: AXIS 70U Network Document Server Web Interface Versions Affected: 3.0 Vendor URL...
Axis 70U Network Document Server multiple security vulnerabilities
Privilege escalation, unauthorized files acccess, crossite scripting...
AXIS 70U Network Document Server Privilege Escalation/XSS
Exploit for hardware platform in category remote exploits ========================================================= AXIS 70U Network Document Server Privilege Escalation/XSS ========================================================= Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXI...
AXIS 70U Privilege Escalation / XSS
DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS Vulnerabilities found in Web Interface of device AXIS 70U Network Document Server. 1. Local File Include and Privilege Escalation. Standard user can escalate privileges to administrator. 2. Multiple Linked XSS...
Adobe Document Server for Reader Extensions < 6.1 Multiple Vulnerabilities
The remote host is running Adobe Document Server, a server that dynamically creates and manipulates PDF documents as well as graphic images. The version of Adobe Document Server installed on the remote host includes the Adobe Document Server for Reader Extensions component, which itself is affect...
CVE-2006-1787
Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...
Design/Logic Flaw
Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading 1 ftp or 2 http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this...
CVE-2006-1788
Adobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks...
CVE-2006-1786
Cross-site scripting XSS vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via 1 the actionID parameter in ads-readerext and 2 the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses...
Cross site scripting
Cross-site scripting XSS vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via 1 the actionID parameter in ads-readerext and 2 the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses...
CVE-2006-1785
Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading 1 ftp or 2 http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this...