RSS   Vulnerabilities for 'Logicaldoc'   RSS

2020-12-03
 
CVE-2020-13542

CWE-276
 
 
A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service, both which get executed by a service thus executing arbitrary commands with System privileges.

 
2020-04-08
 
CVE-2020-10366

CWE-22
 
 
LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.

 
2020-03-18
 
CVE-2020-9423

CWE-434
 
 
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges.

 
2019-05-30
 
CVE-2019-9723

CWE-22
 
 
LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry.

 
2017-07-17
 
CVE-2017-1000023

CWE-79
 
 
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.

 
 
CVE-2017-1000022

CWE-732
 
 
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.

 
 
CVE-2017-1000021

CWE-611
 
 
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.

 

Copyright 2024, cxsecurity.com

 

Back to Top