Затронутые ветки версий
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2021-3199 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3... | * | 9.8 | KEV | 30.2% | 2021-01-22 |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | ≥ 2.5.0 < 10.0.0 | 6.3 | — | 2026-10-14 | |
| CVE-2026-110385 | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authentica... | < 10.0 | 8.7 | — | 2026-10-14 | |
| CVE-2026-41034 | ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via... | * | 5.0 | — | 2026-04-16 | |
| CVE-2025-68936 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. | * | 6.4 | — | 2025-12-26 | |
| CVE-2025-68935 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is re... | * | 6.4 | — | 2025-12-26 | |
| CVE-2025-68917 | ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to Docume... | * | 6.4 | — | 2025-12-25 | |
| CVE-2025-5301 | Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) | * | 6.1 | — | 2025-06-12 | |
| CVE-2023-30188 | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to c... | * | — | — | 2023-08-14 | |
| CVE-2023-30187 | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote at... | * | — | — | 2023-08-14 | |
| CVE-2023-30186 | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to... | * | — | — | 2023-08-14 | |
| CVE-2022-47412 | ONLYOFFICE Workspace Search Stored XSS | * | 5.4 | — | 2023-02-08 | |
| CVE-2022-29777 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap over... | * | — | — | 2022-06-01 | |
| CVE-2022-29776 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack ove... | * | — | — | 2022-06-01 | |
| CVE-2022-24229 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote a... | * | — | — | 2022-04-08 | |
| CVE-2021-25833 | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21.... | * | — | — | 2021-03-02 | |
| CVE-2021-25832 | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE D... | * | — | — | 2021-03-02 | |
| CVE-2021-25831 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An at... | * | — | — | 2021-03-02 | |
| CVE-2021-25830 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13.... | * | — | — | 2021-03-02 | |
| CVE-2021-25829 | An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0... | * | — | — | 2021-03-02 | |
| CVE-2020-11534 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and... | * | — | — | 2020-04-15 | |
| CVE-2020-11535 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and... | * | — | — | 2020-04-15 | |
| CVE-2020-11536 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and... | * | — | — | 2020-04-15 | |
| CVE-2020-11537 | A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQ... | * | — | — | 2020-04-15 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).