Skip to content
Noroxi

ONLYOFFICE records

31 published records for vendor onlyoffice.

Researcher profile

Entered KEV
1 · 3.2%
Weaponized
1 · 3.2%
Pre-auth RCE
9
With a fix record
0%
Median publish → KEV
2081 days

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

31 records
  • CVE-2021-3199
    75This week

    Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..

    CriticalCVSS 9.8KEVWeaponizedEPSS 19%

    onlyoffice · document serverJan 26, 2021

  • CVE-2021-25833
    52Plan

    A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21.

    CriticalCVSS 9.8No exploitEPSS 44%

    onlyoffice · document serverMar 1, 2021

  • CVE-2021-25832
    43Plan

    A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0.

    CriticalCVSS 9.8No exploitEPSS 13%

    onlyoffice · document serverMar 1, 2021

  • CVE-2021-25830
    43Plan

    A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13.

    CriticalCVSS 9.8No exploitEPSS 12%

    onlyoffice · document serverMar 1, 2021

  • CVE-2021-25831
    42Plan

    A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.

    CriticalCVSS 9.8No exploitEPSS 12%

    onlyoffice · document serverMar 1, 2021

  • CVE-2022-29776
    41Plan

    Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component Deskto

    CriticalCVSS 9.8No exploitEPSS 7%

    onlyoffice · coreJun 2, 2022

  • CVE-2022-29777
    41Plan

    Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component Desktop

    CriticalCVSS 9.8No exploitEPSS 7%

    onlyoffice · coreJun 2, 2022

  • CVE-2023-34939
    41Plan

    Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadPro

    CriticalCVSS 9.8No exploitEPSS 5%

    onlyoffice · onlyofficeJun 22, 2023

  • CVE-2020-11536
    40Plan

    An issue was discovered in ONLYOFFICE Document Server 5.5.0.

    CriticalCVSS 9.8No exploitEPSS 3%

    onlyoffice · document serverApr 15, 2020

  • CVE-2023-30187
    40Plan

    An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · document serverAug 14, 2023

  • CVE-2020-11535
    40Plan

    An issue was discovered in ONLYOFFICE Document Server 5.5.0.

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · document serverApr 15, 2020

  • CVE-2021-40864
    40Plan

    The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · google translateSep 10, 2021

  • CVE-2023-30186
    40Plan

    A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · document serverAug 14, 2023

  • CVE-2020-11534
    40Plan

    An issue was discovered in ONLYOFFICE Document Server 5.5.0.

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · document serverApr 15, 2020

  • CVE-2021-43445
    40Plan

    ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

    CriticalCVSS 9.8No exploitEPSS 2%

    onlyoffice · serverJan 23, 2023

  • CVE-2020-11537
    39Monitor

    A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0.

    CriticalCVSS 9.8No exploitEPSS 1%

    onlyoffice · document serverApr 15, 2020

  • CVE-2021-25829
    32Monitor

    An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.

    HighCVSS 7.5No exploitEPSS 7%

    onlyoffice · document serverMar 1, 2021

  • CVE-2021-43449
    32Monitor

    ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).

    HighCVSS 8.1No exploitEPSS 1%

    onlyoffice · serverJan 23, 2023

  • CVE-2023-30188
    31Monitor

    Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via c

    HighCVSS 7.5No exploitEPSS 2%

    onlyoffice · document serverAug 14, 2023

  • CVE-2022-48422
    31Monitor

    ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the cur

    HighCVSS 7.8No exploitEPSS 0%

    onlyoffice · document serverMar 18, 2023

  • CVE-2021-43447
    30Monitor

    ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

    HighCVSS 7.5No exploitEPSS 1%

    onlyoffice · serverJan 23, 2023

  • CVE-2021-43444
    30Monitor

    ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

    HighCVSS 7.5No exploitEPSS 1%

    onlyoffice · serverJan 23, 2023

  • CVE-2023-46988
    26Monitor

    Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th

    MediumCVSS 6.7Proof of conceptEPSS 1%

    onlyoffice · document serverApr 1, 2025

  • CVE-2022-24229
    25Monitor

    A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML

    MediumCVSS 6.1No exploitEPSS 2%

    onlyoffice · document serverApr 8, 2022

  • CVE-2021-43446
    24Monitor

    ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 6.1No exploitEPSS 1%

    onlyoffice · serverJan 23, 2023