Server (Onlyoffice) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2023-01-23. Vendor: Onlyoffice.

CVEs of Server

• CVE-2021-43446 - CVSS 6.1 (medium), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site…
• CVE-2021-43449 - CVSS 8.1 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve…
• CVE-2021-43445 - CVSS 9.8 (critical), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE…
• CVE-2021-43448 - CVSS 5.3 (medium), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of…
• CVE-2021-43444 - CVSS 7.5 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL…
• CVE-2021-43447 - CVSS 7.5 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit…