Vendor
CollaboraOnline
18 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Medium 4.3
Collabora Online: Read-only session authorization bypass permits live document edits
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A r…
-
Medium 4.7
Collabora Online: Reflected HTML injection through host_session_id
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed…
-
Medium 5.3
Collabora Online vulnerable to Authorization Bypass
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only right…
-
Medium 6.3
Remote Code Execution within Collabora Online jail with Macros Enabled
Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowe…
-
Medium 6.3
JavaScript Injection via url encoded values in links in Collabora Office Android
Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the And…
-
Medium 6.1
Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip
Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Collabora Online. An attacker could create a document with an XSS payload in document text referenced by field which, if hov…
-
Medium 4.3
Reflected XSS vulnerability in CollaboraOnline
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be e…