CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC exploit.html を localhost のポート 80 でホストします。docx を開くと calc が起動します。 doc が参照するリモートアドレスを変更するには、7Z で開き、word\rels\document.xml.rels を編集して新しい場所を指定します。感嘆符（!）は必ず保持してください。これを URL の末尾から省略すると、文字通り実行されません。 エクスプロイトは window.location.href の前に少なくとも 3541...

EUVD-2019-7115

Malware in sbrugna...

Ascensio System ONLYOFFICE Document Server Input Validation Error Vulnerability

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among others. An input validation error vulnerability exists in Ascensio System ONLYOFFICE Document...

CVE-2020-11536

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...

CVE-2019-16337

The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file...

CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

CVE-2019-16338

The CVE-2019-16338 issue affects Hancom Office’s HwordApp.dll (tfo_common) in version 9.6.1.7634, where a crafted .docx enables a use-after-free vulnerability. Public sources in the connected docs describe the flaw and corroborate that it can lead to arbitrary code execution. CVSS data indicates ...