DzzOffice Cross-Site Scripting Vulnerability

Dzzoffice is a set of open source office suite for enterprises, teams to build their own similar to the "Google Apps Suite", "Microsoft Office365" enterprise collaboration platform. A cross-site scripting vulnerability exists in attach/ajax.php in DzzOffice 2.02.1 and earlier versions. The...

CVE-2021-3318

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

CVE-2021-3318

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

CVE-2021-3318

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

Design/Logic Flaw

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

CVE-2021-3318

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

CVE-2021-3318

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

CVE-2021-3318

CVE-2021-3318 affects DzzOffice

CVE-2021-3318: Improper Neutralization of Input During Web Page Generation

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter...

DzzOffice 跨站脚本漏洞

Dzzoffice is a set of open source office suite for enterprises, teams to build their own similar to the "Google Apps Suite", "Microsoft Office365" enterprise collaboration platform. A cross-site scripting vulnerability exists in attach/ajax.php in DzzOffice 2.02.1 and earlier versions. The...

PT-2021-20063

Name of the Vulnerable Software and Affected Versions DzzOffice versions 2.02.1 and earlier Description The issue allows for XSS via the editorid parameter in the "attach/ajax.php" endpoint. Recommendations For DzzOffice versions 2.02.1 and earlier, as a temporary workaround, consider restricting...

Dzzoffice v1.3.1 Arbitrary File Download Vulnerability in Multiple Pages

DzzOffice is an open source cloud storage management tool. Dzzoffice v1.3.1 Arbitrary file download vulnerability exists in the 'pdfviewer.php', 'view.php', 'download.php' and 'attachment.php' pages, which can be exploited by attackers to obtain sensitive information...

DzzOffice v1.3.1 Arbitrary File Download Vulnerability in Frontend

DzzOffice is a cloud storage management tool , based on the free open source release , can be used as a personal network disk , team , enterprise network disk for use . DzzOffice v1.3.1 front-end arbitrary file download vulnerability exists due to the program fails to share path parameter for...

File Upload Vulnerability in DzzOffice v1.3.1 Frontend

DzzOffice is a cloud storage management tool , based on the free open source release , can be used as a personal network disk , team , enterprise network disk for use . A file upload vulnerability exists in DzzOffice v1.3.1 due to the program failing to strictly filter the $GET'tpath' parameter. ...

DzzOffice v1.3.1 SQL Injection Vulnerability in Frontend

DzzOffice is a cloud storage management tool , based on the free open source release , can be used as a personal network disk , team , enterprise network disk for use . A SQL injection vulnerability exists in DzzOffice v1.3.1 due to the program failing to strictly filter the keyword parameter...

Arbitrary File Read Vulnerability in DzzOffice

DzzOffice is an open source cloud storage management tool. DzzOffice has an arbitrary file read vulnerability that can be exploited by an attacker to read arbitrary files and obtain sensitive information...

dzzoffice 任意文件包含

No description provided by source...

dzzoffice 任意文件删除

No description provided by source...

DzzOffice 1.2.3 /dzz/market/index.php SQL注入漏洞

No description provided by source...

DzzOffice 1.2.2 /index.php 本地文件包含漏洞

Index.php$dzz = C::app; $mod = getgpc'mod'; $mod = !empty$mod ? $mod : ''; $op = !empty$GET'op' ? $GET'op' : 'index'; $cachelist = array; $dzz-cachelist = $cachelist; $dzz-init; //调用各自的模块 ifempty$mod if$G'uid'1 && $G'setting''loginset''available' @header"Location: user.php?mod=logging"; exit;...