CVE-2020-10366

LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365...

LogicalDOC Arbitrary File Upload Vulnerability

LogicalDOC is a set of document management system developed using Java technology . The system has Lucene full-text search indexing and automatic import and other functions. A security vulnerability exists in LogicalDoc versions prior to 8.3.3. The vulnerability can be exploited to upload arbitra...

LogicalDoc SQL Injection Vulnerability

LogicalDOC is a set of document management system developed using Java technology . The system has Lucene full-text search indexing and automatic import and other functions. A SQL injection vulnerability exists in LogicalDoc versions prior to 8.3.3. The vulnerability stems from a lack of validati...

CVE-2020-10365

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

CVE-2020-9423

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

CVE-2020-9423

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

CVE-2020-10365

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

Design/Logic Flaw

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

Sql injection

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

CVE-2020-10365

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

CVE-2020-10365

CVE-2020-10365 affects LogicalDOC before 8.3.3. The vulnerability is a SQL Injection in the document-list query, where the application builds the list of available documents by querying the database and some parameters are not properly sanitized. An authenticated attacker could leverage this to p...

CVE-2020-9423

CVE-2020-9423 affects LogicalDOC before 8.3.3. The vulnerability stems from the document-add feature, which can be abused by an unauthenticated attacker to upload an arbitrary file into a restricted folder, enabling command execution with root privileges. The available sources describe the issue ...

CVE-2020-9423

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

LogicalDoc Virtual Appliance Multiple Vulnerabilities

1. Advisory Information Title: LogicalDoc Virtual Appliance Multiple Vulnerabilities Advisory ID: CORE-2019-004 Advisory URL: Date published: 2020-03-18 Date of last update: 2020-03-17 Vendors contacted: LogicalDoc Release mode: Coordinated release 2. Vulnerability Information Class: Unrestricted...

LogicalDoc Virtual Appliance Multiple Vulnerabilities

Advisory ID Internal CORE-2020-004 1. Advisory Information Title: LogicalDoc Virtual Appliance Multiple Vulnerabilities Advisory ID: CORE-2020-004 Date published: 2020-03-18 Date of last update: 2020-03-17 Vendors contacted: LogicalDoc Release mode: Coordinated release 2. Vulnerability...

LogicalDOC Path Traversal Vulnerability

LogicalDOC is a set of document management system developed using Java technology . The system has Lucene full-text search indexing and automatic import and other functions. A path traversal vulnerability exists in LogicalDOC Community Edition version 8.x prior to 8.2.1. The vulnerability stems...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

Path traversal

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

CVE-2019-9723

Summary: CVE-2019-9723 affects LogicalDOC Community Edition 8.x before 8.2.1. The vulnerability is a path traversal in the PluginRegistry that enables reading arbitrary files and creating directories outside the intended scope. Public sources in the connected set corroborate that the issue reside...