Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
onlyoffice document server vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2022-29776
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp.
Onlyoffice Core
Onlyoffice Document Server
1 Github repository
9.8
CVSSv3
CVE-2022-29777
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.
Onlyoffice Core
Onlyoffice Document Server
1 Github repository
9.8
CVSSv3
CVE-2021-25830
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker...
Onlyoffice Document Server
9.8
CVSSv3
CVE-2021-25831
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacke...
Onlyoffice Document Server
9.8
CVSSv3
CVE-2021-25833
A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain ...
Onlyoffice Document Server
6.1
CVSSv3
CVE-2022-24229
A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.
Onlyoffice Document Server
9.8
CVSSv3
CVE-2023-30186
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 up to and including 7.3.2 allows remote malicious users to run arbitrary code via crafted JavaScript file.
Onlyoffice Document Server
9.8
CVSSv3
CVE-2023-30187
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 up to and including 7.3.2 allows remote malicious users to run arbitrary code via crafted JavaScript file.
Onlyoffice Document Server
7.5
CVSSv3
CVE-2023-30188
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 up to and including 7.3.2 allows remote malicious users to cause a denial of service via crafted JavaScript file.
Onlyoffice Document Server
7.5
CVSSv3
CVE-2021-25829
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.
Onlyoffice Document Server
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
brute force
CVE-2024-24908
open redirect
CVE-2024-31497
CVE-2023-45866
CVE-2024-4135
CVE-2024-25523
cache poisoning
CVE-2024-4649
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »