261 matches found
PT-2021-19901
Name of the Vulnerable Software and Affected Versions Collabora Online versions prior to 6.4.9-5 Description A reflected XSS issue was found in Collabora Online, allowing an attacker to inject unescaped HTML into a variable as they created the Collabora Online iframe. This could execute scripts...
CVE-2021-32744: Authorization Bypass Through User-Controlled Key
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to...
Collabora Online 跨站脚本漏洞
Collabora Online is an application from Collabora. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A cross-site scripting vulnerability exists in Collabora Online versions prior to 6.4.9-5. The vulnerability allows an attacke...
CVE-2021-32745: Improper Neutralization of Input During Web Page Generation
Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabo...
PT-2021-19900
Name of the Vulnerable Software and Affected Versions Collabora Online versions prior to 4.2.17-1 Collabora Online version 6.4.9-5 Description Collabora Online is a collaborative online office suite. Unauthenticated attackers can gain access to files currently opened by other users in the Collabo...
Collabora Online 安全漏洞
Collabora Online is an application from Collabora. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A security vulnerability exists in Collabora Online versions 4.2.17-1 through 6.4.9-5, which allows an unauthenticated attacke...
Nextcloud: Virtual Data Room / Hide download on collabora is easy to bypass
So, let me start with saying I'm not sure if this is a security issue or if it is by design. The reason I'm reporting it here is since Nextcloud promotes this Virtual Data Room a lot...
Nextcloud: Stored XSS in collabora via user name
Affected: collabora and nextcloud Ubuntu 18.04.5 LTS Nextcloud 19.0.1 snap version collabora CODE The name of the user is displayed when him joins to edit the document allowing the attacker trigger xss. Impact Set the name of the attacker account to Create a new document → share the document with...
Collabora CODE WOPI API Cross-Site Scripting Vulnerability
Collabora CODE is a collaborative office solution from Collabora UK. The product supports online document editing and viewing, etc. WOPI API is one of the WOPI Web Application Open Platform Interface Protocol APIs. A security vulnerability exists in the WOPI API integration in Collabora CODE 4.2....
CVE-2020-12432
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...
Improper access control
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...
CVE-2020-12432
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...
CVE-2020-12432
Summary: CVE-2020-12432 affects Collabora CODE/WOPI integration used by Vereign Collabora CODE up to version 4.2.2. The vulnerability arises from improper restriction of JavaScript delivery to a user’s browser and weak MIME-type access control, enabling cross-site scripting that can steal credent...
PT-2020-13111
Name of the Vulnerable Software and Affected Versions Vereign Collabora CODE versions through 4.2.2 Description The issue concerns the WOPI API integration, which fails to properly restrict JavaScript delivery to a victim's browser and lacks proper MIME type access control. This could lead to...
CVE-2020-12432: Improper Neutralization of Input During Web Page Generation
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...
Collabora CODE / Collabora Online / LibreOffice Online / OxOffice Online / Claro drive Detection (HTTP)
HTTP based detection of Collabora CODE Collabora Online Development Edition, Collabora Online, LibreOffice Online, OxOffice Online, Claro drive and similar other LibreOffice Online based products. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a reference...
Debian DSA-2971-1 : dbus - security update
Several vulnerabilities have been discovered in dbus, an asynchronous inter-process communication system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-3477 Alban Crequy at Collabora Ltd. discovered that dbus-daemon sends an AccessDenied error to...
[SECURITY] [DSA 2971-1] dbus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2971-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso July 02, 2014 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2971-1] dbus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2971-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso July 02, 2014 http://www.debian.org/security/faq -...
