Search
Total
17 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-29052 | 1 Open-xchange | 1 Ox App Suite | 2024-01-12 | N/A | 5.4 MEDIUM |
| Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known. | |||||
| CVE-2023-29049 | 1 Open-xchange | 1 Ox App Suite | 2024-01-12 | N/A | 6.1 MEDIUM |
| The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known. | |||||
| CVE-2023-41710 | 1 Open-xchange | 1 Ox App Suite | 2024-01-12 | N/A | 5.4 MEDIUM |
| User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known. | |||||
| CVE-2022-24406 | 1 Open-xchange | 1 Ox App Suite | 2023-08-08 | N/A | 6.5 MEDIUM |
| OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | |||||
| CVE-2021-38374 | 1 Open-xchange | 1 Ox App Suite | 2022-07-22 | 3.5 LOW | 5.4 MEDIUM |
| OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. | |||||
| CVE-2021-38378 | 1 Open-xchange | 1 Ox App Suite | 2022-07-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. | |||||
| CVE-2021-38377 | 1 Open-xchange | 1 Ox App Suite | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. | |||||
| CVE-2021-38376 | 1 Open-xchange | 1 Ox App Suite | 2022-07-12 | 5.0 MEDIUM | 5.3 MEDIUM |
| OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | |||||
| CVE-2021-33494 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. | |||||
| CVE-2021-33491 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 4.0 MEDIUM | 6.5 MEDIUM |
| OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records. | |||||
| CVE-2021-33493 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 3.6 LOW | 6.0 MEDIUM |
| The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. | |||||
| CVE-2021-33492 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite 7.10.5 allows XSS via an OX Chat room name. | |||||
| CVE-2021-33488 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 5.8 MEDIUM | 6.1 MEDIUM |
| chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. | |||||
| CVE-2021-38375 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. | |||||
| CVE-2021-33495 | 1 Open-xchange | 1 Ox App Suite | 2021-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite 7.10.5 allows XSS via an OX Chat system message. | |||||
| CVE-2021-33490 | 1 Open-xchange | 1 Ox App Suite | 2021-11-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. | |||||
| CVE-2021-33489 | 1 Open-xchange | 1 Ox App Suite | 2021-11-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. | |||||