If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data, an arbitrary OS command may be executed on the system where the product is installed.Ĭollabora Online is a collaborative online office suite based on LibreOffice technology. OS command injection vulnerability exists in WPS Office version 10. Microsoft Office Remote Code Execution Vulnerability Users should upgrade to Collabora Online 22.05.13 or higher Collabora Online 21.11.9.1 or higher Collabora Online 6.4.27 or higher to receive a patch. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw.
Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. An attacker could create a document with an XSS payload as a document name. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. Collabora Online is a collaborative online office suite.
0 kommentar(er)
