CVE-2020-10365

CVE-2020-10365 affects LogicalDOC before 8.3.3. The vulnerability is a SQL Injection in the document-list query, where the application builds the list of available documents by querying the database and some parameters are not properly sanitized. An authenticated attacker could leverage this to p...

CVE-2020-10365

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

CVE-2020-9423

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

CVE-2020-9423

CVE-2020-9423 affects LogicalDOC before 8.3.3. The vulnerability stems from the document-add feature, which can be abused by an unauthenticated attacker to upload an arbitrary file into a restricted folder, enabling command execution with root privileges. The available sources describe the issue ...

PT-2020-12042

Name of the Vulnerable Software and Affected Versions LogicalDoc versions prior to 8.3.3 Description The issue allows SQL Injection, where an authenticated attacker could perform arbitrary queries to the database by modifying certain parameters that are not properly sanitized. This is related to...

PT-2020-20648

Name of the Vulnerable Software and Affected Versions LogicalDoc versions prior to 8.3.3 Description The issue allows an attacker to upload arbitrary files, potentially leading to command execution or retrieval of data from the database. This is due to the abuse of the document addition...

CVE-2020-10365: Improper Neutralization of Special Elements used in an SQL Command

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary...

LogicalDoc Virtual Appliance Multiple Vulnerabilities

1. Advisory Information Title: LogicalDoc Virtual Appliance Multiple Vulnerabilities Advisory ID: CORE-2019-004 Advisory URL: Date published: 2020-03-18 Date of last update: 2020-03-17 Vendors contacted: LogicalDoc Release mode: Coordinated release 2. Vulnerability Information Class: Unrestricted...

LogicalDoc Virtual Appliance Multiple Vulnerabilities

Advisory ID Internal CORE-2020-004 1. Advisory Information Title: LogicalDoc Virtual Appliance Multiple Vulnerabilities Advisory ID: CORE-2020-004 Date published: 2020-03-18 Date of last update: 2020-03-17 Vendors contacted: LogicalDoc Release mode: Coordinated release 2. Vulnerability...

CVE-2020-9423: Unrestricted Upload of File with Dangerous Type

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

LogicalDOC Path Traversal Vulnerability

LogicalDOC is a set of document management system developed using Java technology . The system has Lucene full-text search indexing and automatic import and other functions. A path traversal vulnerability exists in LogicalDOC Community Edition version 8.x prior to 8.2.1. The vulnerability stems...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

Path traversal

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

CVE-2019-9723

Summary: CVE-2019-9723 affects LogicalDOC Community Edition 8.x before 8.2.1. The vulnerability is a path traversal in the PluginRegistry that enables reading arbitrary files and creating directories outside the intended scope. Public sources in the connected set corroborate that the issue reside...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

PT-2019-19821

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions 8.0 through 8.2.0 Description The issue allows for path traversal, enabling the reading of arbitrary files and the creation of directories. This is due to a vulnerability in the PluginRegistry class...

CVE-2019-9723: Improper Limitation of a Pathname to a Restricted Directory

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

LogicalDOC 8.2 Path Traversal Vulnerability

Impact In order to exploit this vulnerability an attacker needs to be an authenticated read-only user of the role guest. The attacker can read arbitrary files and create arbitrary directories on the server with the permissions of the user running the web server. It is recommended to update...

LogicalDOC Detection (HTTP)

HTTP based detection of LogicalDOC. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.140769";...