2026-11-03T22:57:36Z https://nostr.now CERT Coordination Center https://nostr.now/npub1vtvx95k0cglyy4pq4tytzajuxwhr2nm9klm6weznqd3nx9fnhxwsfn56ng https://media.infosec.exchange/infosec.exchange/accounts/avatars/114/217/077/097/442/143/original/9f77c5ba71a2bb1d.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/114/217/077/097/442/143/original/9f77c5ba71a2bb1d.png https://nostr.now/nevent1qqspy2luwfjddke0ssfhm066k65lgxm8h597mrjpcp469jg7s0a2hjszyp3dsckjelprusj5yz4v3vtktse6ud20vkml0fmy2vpkxvc4xwue68mk4xa VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability <a href="https://kb.cert.org/vuls/id/943094">https://kb.cert.org/vuls/id/943094</a><br/>Overview<br/>A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA&#39;s ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the 2026-09-08T15:44:18Z