K0R0L

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 **Description** A use after free issue in ONLYOFFICE DocumentServer allows remote attackers to run arbitrary code via a crafted JavaScript file. This issue is related to the JavaScript File Handler component and can be exploited by running a specially formed JavaScript file, enabling the attacker to execute arbitrary code. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using crafted JavaScript files in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE Document Server versions 4.0.3 through 7.3.2 **Description** The issue is related to a Memory Exhaustion vulnerability in the JavaScript File Handler component of ONLYOFFICE Document Server. This vulnerability allows remote attackers to cause a denial of service via a crafted JavaScript file. The exploitation of this vulnerability is associated with incorrect cleanup or release of resources. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround to minimize the risk of exploitation until a patch is available. Restrict access to crafted JavaScript files to prevent remote attackers from causing a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 **Description** An out of bounds memory access issue in the JavaScript File Handler component allows remote attackers to execute arbitrary code via a crafted JavaScript file. This can be exploited by running a specially formed JavaScript file, potentially leading to code execution. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using crafted JavaScript files in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Onlyoffice Document Server versões 6.0.0 e anteriores Onlyoffice Core versões 6.1.0.26 e anteriores **Descrição** Foi detectada uma vulnerabilidade de estouro de pilha no componente DesktopEditor/common/File.cpp. **Recomendações** Para as versões 6.0.0 e anteriores do Onlyoffice Document Server, atualize para uma versão superior à 6.0.0. Para as versões 6.1.0.26 e anteriores do Onlyoffice Core, atualize para uma versão superior à 6.1.0.26.

**Nome do software vulnerável e versões afetadas** Onlyoffice Document Server versões 6.0.0 e anteriores Onlyoffice Core versões 6.1.0.26 e anteriores **Descrição** Foi detectada uma vulnerabilidade de estouro de pilha no componente DesktopEditor/fontengine/fontconverter/FontFileBase.h. **Recomendações** Para as versões 6.0.0 e anteriores do Onlyoffice Document Server, atualize para uma versão superior à 6.0.0. Para as versões 6.1.0.26 e anteriores do Onlyoffice Core, atualize para uma versão superior à 6.1.0.26.