192 matches found
CVE-2020-11537
ONLYOFFICE Document Server 5.5.0 is affected by a SQL Injection vulnerability that allows an attacker to execute arbitrary SQL queries via the DocID parameter of the Websocket API. Root cause: improper handling of input in the Websocket API leading to SQL injection. Impact: high/severe confidenti...
CVE-2020-11537
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
CVE-2020-11534: Improper Input Validation
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary such as curl or wget and remotely execute code on a victim's server...
CVE-2020-11537: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API...
CVE-2020-11535: XML Injection (aka Blind XPath Injection)
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server...
CVE-2020-11536: Improper Input Validation
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...
Adobe Document Server 6.0 Extensions ads-readerext actionID Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17500/info Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to: - perform cross-site scripting attacks -...
Adobe Document Server 6.0 Extensions AlterCast op Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17500/info Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to: - perform cross-site scripting attacks -...
AXIS 70U Network Document Server Privilege Escalation/XSS
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS http://dsecrg.com/pages/vul/show.php?id=60 Application: AXIS 70U Network Document Server Web Interface Versions Affected: 3.0 Vendor URL...
Axis 70U Network Document Server multiple security vulnerabilities
Privilege escalation, unauthorized files acccess, crossite scripting...
AXIS 70U Network Document Server Privilege Escalation/XSS
Exploit for hardware platform in category remote exploits ========================================================= AXIS 70U Network Document Server Privilege Escalation/XSS ========================================================= Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXI...
AXIS 70U Privilege Escalation / XSS
DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS Vulnerabilities found in Web Interface of device AXIS 70U Network Document Server. 1. Local File Include and Privilege Escalation. Standard user can escalate privileges to administrator. 2. Multiple Linked XSS...
Adobe Document Server for Reader Extensions < 6.1 Multiple Vulnerabilities
The remote host is running Adobe Document Server, a server that dynamically creates and manipulates PDF documents as well as graphic images. The version of Adobe Document Server installed on the remote host includes the Adobe Document Server for Reader Extensions component, which itself is affect...
CVE-2006-1787
Adobe Document Server for Reader Extensions 6.0 includes a user's session jsession ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session...
CVE-2006-1786
Cross-site scripting XSS vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via 1 the actionID parameter in ads-readerext and 2 the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses...
Cross site scripting
Cross-site scripting XSS vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via 1 the actionID parameter in ads-readerext and 2 the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses...
Design/Logic Flaw
Adobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks...
CVE-2006-1785
Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading 1 ftp or 2 http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this...
CVE-2006-1788
Adobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks...
Design/Logic Flaw
Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading 1 ftp or 2 http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this...