407 matches found
PT-2023-12450 · Unknown · Onlyoffice
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE versions prior to the version released after 2021-11-08 Description: The issue concerns a Cross Site Scripting XSS problem. The "macros" feature of the document editor in ONLYOFFICE allows malicious cross site scripting payloads to...
CVE-2021-43449
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...
CVE-2021-43445
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key...
CVE-2021-43448
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...
CVE-2021-43449
CVE-2021-43449 affects ONLYOFFICE all versions as of 2021-11-08. The Document Editor service is vulnerable to Server-Side Request Forgery (SSRF), enabling reading and serving arbitrary URLs as documents. CVSS v3.1 base score 8.1 (HIGH) with NETWORK attack vector, LOW attack complexity, no privile...
PT-2023-12451 · Unknown · Onlyoffice
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE all versions as of 2021-11-08 Description: The issue is related to Incorrect Access Control, specifically an authentication bypass in the document editor. This allows attackers to edit documents without proper authentication...
CVE-2021-43448
The CVE-2021-43448 issue affects ONLYOFFICE all versions up to 2021-11-08 and stems from Improper Input Validation. The vulnerability could allow an attacker to spoof the names of users interacting with a document when the document ID is known. Connected sources corroborate the affected product a...
CVE-2021-43446
ONLYOFFICE Docs prior to 8.1.0 are affected by XSS involving macros. The vulnerability stems from macros defined as Immediately-Invoked Function Expressions (IIFEs), enabling sandbox escape by calling the Function constructor. Related CVEs (CVE-2021-43446 and CVE-2023-50883) describe the same mac...
PT-2022-11839
Name of the Vulnerable Software and Affected Versions ONLYOFFICE all versions as of 2021-11-08 Description The issue is related to Incorrect Access Control, where signed document download URLs can be forged due to a weak default URL signing key. This allows for potential exploitation, including...
CVE-2022-29776
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp...
CVE-2022-29776
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp...
CVE-2022-29777
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h...
CVE-2022-29777
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h...
Design/Logic Flaw
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h...
Stack overflow
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp...
Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞
Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets, presentations and more. A security vulnerability exists in Ascensio System ONLYOFFICE Document Server version v6.0.0 and...
Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞
Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among other things. A security vulnerability exists in Onlyoffice Document Server version v6.0.0 and...
CVE-2022-29777
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h...
CVE-2022-29777
Summary: CVE-2022-29777 affects Onlyoffice Document Server (versions ≤ 6.0.0) and Onlyoffice Core (versions ≤ 6.1.0.26). The vulnerability is a heap overflow in the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. Impact : not explicitly quantified beyond the heap overflow in the ...
