OS command injection vulnerability exists in WPS Office version 10.
Microsoft Office Remote Code Execution Vulnerability Users should upgrade to Collabora Online 22.05.13 or higher Collabora Online 21.11.9.1 or higher Collabora Online 6.4.27 or higher to receive a patch. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console.
An attacker could create a document with an XSS payload as a document name. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. Collabora Online is a collaborative online office suite.
0 kommentar(er)
