415 matches found
Ascensio System ONLYOFFICE 代码问题漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in ONLYOFFICE Docs versions prior to 7.3 that originates from a vulnerability that allows local users to gain privileges via the Trojan horse libgccs.so.1 in the current working director...
CVE-2022-48422
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgccs.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located...
CVE-2022-48422
CVE-2022-48422 affects ONLYOFFICE Docs up to version 7.3 on certain Linux distributions. The vulnerability arises from a Trojan horse libgcc_s.so.1 placed in the current working directory, which an ONLYOFFICE document can reside in, allowing local privilege escalation. Connected sources consisten...
PT-2023-1742 · Onlyoffice · Onlyoffice Docs
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs versions prior to 7.3 Description: The issue is related to the use of an insecure path search in the ONLYOFFICE Docs online text document editor. Exploitation of this issue may allow an attacker to execute arbitrary code by...
Unpatched Security Flaws Disclosed in Multiple Document Management Systems
Multiple unpatched security flaws have been disclosed in open source and freemium Document Management System DMS offerings from four vendors LogicalDOC, Mayan, ONLYOFFICE, and OpenKM. Cybersecurity firm Rapid7 said the eight vulnerabilities offer a mechanism through which "an attacker can convinc...
CVE-2022-47412
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
CVE-2022-47412
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
CVE-2022-47412 ONLYOFFICE Workspace Search Stored XSS
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
CVE-2022-47412
Technical details about CVE-2022-47412 are not publicly provided in the connected documents. Monitor for updates.
CVE-2022-47412 ONLYOFFICE Workspace Search Stored XSS
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition...
Multiple DMS XSS (CVE-2022-47412 through CVE-20222-47419)
Through the course of routine security testing and analysis, Rapid7 has discovered several issues in on-premises installations of open source and freemium Document Management System DMS offerings from four vendors. While all of the discovered issues are instances of CWE-79: Improper Neutralizatio...
Ascensio System ONLYOFFICE 跨站脚本漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in Ascensio System ONLYOFFICE Workspace DMS. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...
CVE-2021-43447
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication...
CVE-2021-43444
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key...
CVE-2021-43445
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key...
CVE-2021-43446
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting XSS. The "macros" feature of the document editor allows malicious cross site scripting payloads to be used...
CVE-2021-43448
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...
CVE-2021-43445
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key...