CVE-2020-11536

CVE-2020-11536 affects ONLYOFFICE Document Server 5.5.0. A maliciously crafted .docx can exploit the unzip function to rewrite a binary and remotely execute code on the server. The connected docs confirm the impact as remote code execution via crafted documents, but do not provide a vendor patch ...

CVE-2020-11536

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...

CVE-2020-11537

ONLYOFFICE Document Server 5.5.0 is affected by a SQL Injection vulnerability that allows an attacker to execute arbitrary SQL queries via the DocID parameter of the Websocket API. Root cause: improper handling of input in the Websocket API leading to SQL injection. Impact: high/severe confidenti...

CVE-2020-11537

A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...

onlyoffice.com XSS vulnerability

Open Bug Bounty ID: OBB-696224 Description| Value ---|--- Affected Website:| onlyoffice.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

helpcenter.onlyoffice.com XSS vulnerability

Vulnerable URL: http://helpcenter.onlyoffice.com/search.aspx?text=999%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.02.2016 Latest check for patch:| 23.02.2016 19:22 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

helpcenter.onlyoffice.com XSS vulnerability

Vulnerable URL: http://helpcenter.onlyoffice.com/fr/search.aspx?text=999%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.02.2016 Latest check for patch:| 23.02.2016 19:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...