415 matches found
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
CVE-2023-50883
ONLYOFFICE Docs prior to version 8.0.1 are affected. The issue stems from a macro implemented as an immediately-invoked function expression (IIFE) that enables sandbox escape by calling the Function constructor, leading to XSS. Impact per sources is XSS; affected component is the macro handling i...
CVE-2024-44085
ONLYOFFICE Docs is vulnerable to XSS via a GeneratorFunction object in macros (IIFE) in versions prior to 8.1.0. This issue is linked to an incorrect fix for CVE-2021-43446 and CVE-2023-50883. Affected products/versions: ONLYOFFICE Docs before 8.1.0 (per CVE entries and Red Hat/NVD references). I...
Ascensio System ONLYOFFICE 安全漏洞
Ascensio System ONLYOFFICE is an office software from the Latvian company Ascensio System. A security vulnerability exists in Ascensio System ONLYOFFICE versions prior to 8.1.0 that originates from allowing cross-site scripting attacks on macros via GeneratorFunction Object...
CVE-2024-44085
ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression IIFE for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883...
PT-2024-13990 · Onlyoffice · Onlyoffice Docs
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs versions prior to 8.0.1 Description: The issue is related to an incorrect fix for a previous problem, which allows for Cross-Site Scripting XSS due to a macro being an immediately-invoked function expression IIFE. This enables...
Ascensio System ONLYOFFICE 安全漏洞
Ascensio System ONLYOFFICE is an office software from the Latvian company Ascensio System. A security vulnerability exists in Ascensio System ONLYOFFICE versions prior to 8.0.1, which originates from the ability to sandbox escape by directly calling the constructor of a Function object...
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
PT-2024-30941 · Onlyoffice · Onlyoffice Docs
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs versions prior to 8.1.0 Description: The issue is related to a cross-site scripting XSS flaw in ONLYOFFICE Docs, which occurs through a GeneratorFunction Object attack on a macro. This is connected to the use of an...
The vulnerability of the DocumentHandler component of the ONLYOFFICE Workspace document management system arises due to deficiencies in the encryption of user-input data. This vulnerability allows attackers to execute cross-site scripting (XSS) attacks.
The vulnerability of the DocumentHandler component of the ONLYOFFICE Workspace document management system exists due to deficiencies in the encryption of user-input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the JavaScript File Handler component in the office online package ONLYOFFICE DocumentServer allows a hacker to execute arbitrary code.
The vulnerability of the JavaScript File Handler component in the ONLYOFFICE DocumentServer online package relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code by launching a specially crafted JavaScri...
The vulnerability of the JavaScript File Handler component in the office online package ONLYOFFICE DocumentServer allows a hacker to trigger a service failure.
The vulnerability of the JavaScript File Handler component in the ONLYOFFICE DocumentServer online package is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure by executing a specially crafted JavaScript file...
The vulnerability of the JavaScript File Handler component in the office online package ONLYOFFICE DocumentServer allows a hacker to execute arbitrary code.
The vulnerability of the JavaScript File Handler component in the ONLYOFFICE DocumentServer office online package is related to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by running a specially crafted JavaScript file...
CVE-2023-30187
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file...
CVE-2023-30188
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file...
CVE-2023-30188
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file...