CVE-2024-44085

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.

• CWE-79

• https://www.onlyoffice.com/Product
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txtExploit, Third Party Advisory
• https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027Third Party Advisory

Published

Sep 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44073The Miniscript (aka rust-miniscript) library before 12.2.0 f…7.5
• CVE-2024-44076In Microcks before 1.10.0, the POST /api/import and POST /ap…9.8
• CVE-2024-44080In Jitsi Meet before 2.0.9779, the functionality to share an…7.5
• CVE-2024-44081In Jitsi Meet before 2.0.9779, the functionality to share a …9.8
• CVE-2024-44082In OpenStack Ironic before 26.0.1 and ironic-python-agent be…4.3
• CVE-2024-44083ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there…7.5
• CVE-2024-44087A vulnerability has been identified in Automation License Ma…9.2
• CVE-2024-44088Malicious script injection ('Cross-site Scripting') vulnerab…6.1
• CVE-2024-4409The WP-ViperGB plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2024-44092There is a possible LCS signing enforcement missing due to …7.8
• CVE-2024-44093In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possi…7.8
• CVE-2024-44094In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possi…7.8