CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43446
https://notcve.org/view.php?id=CVE-2021-43446
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used. Todas las versiones de ONLYOFFICE con fecha posterior al 08/11/2021 son vulnerables a Cross Site Scripting (XSS). La función "macros" del editor de documentos permite realizar cross site scripting. • https://github.com/ONLYOFFICE/server https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution https://onlyoffice.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43444
https://notcve.org/view.php?id=CVE-2021-43444
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key. Todas las versiones de ONLYOFFICE a partir del 08/11/2021 se ven afectadas por un control de acceso incorrecto. Las URL de descarga de documentos firmados se pueden falsificar debido a una clave de firma de URL predeterminada débil. • https://github.com/ONLYOFFICE/server https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution https://www.onlyoffice.com • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43449
https://notcve.org/view.php?id=CVE-2021-43449
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document. Todas las versiones de ONLYOFFICE con fecha posterior al 08/11/2021 se ven afectadas por una vulnerabilidad Server-Side Request Forgery (SSRF). Se puede abusar del servicio de edición de documentos para leer y servir URL arbitrarias como documento. • https://github.com/ONLYOFFICE/server https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution https://www.onlyoffice.com • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43447
https://notcve.org/view.php?id=CVE-2021-43447
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication. • https://github.com/ONLYOFFICE/server https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution https://www.onlyoffice.com • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2022-46764
https://notcve.org/view.php?id=CVE-2022-46764
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution. Un problema de inyección SQL en la API web en TrueConf Server 5.2.0.10225 permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios, lo que en última instancia conduce a la ejecución remota de código. • https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46764.txt https://solidlab.ru/our-news/145-trueconf.html https://vuldb.com/?diff.216845 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •