Ox App Suite
by Open-Xchange
CVEs (94)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-24406 | Med | 0.42 | 6.5 | 0.01 | Jul 27, 2022 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | ||
| CVE-2021-33491 | Med | 0.42 | 6.5 | 0.03 | Nov 22, 2021 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records. | ||
| CVE-2020-28943 | Med | 0.42 | 6.5 | 0.01 | Apr 30, 2021 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet. | ||
| CVE-2020-8544 | Med | 0.42 | 6.5 | 0.01 | Jun 16, 2020 | OX App Suite through 7.10.3 allows SSRF. | ||
| CVE-2020-8541 | Med | 0.42 | 6.5 | 0.01 | Jun 16, 2020 | OX App Suite through 7.10.3 allows XXE attacks. | ||
| CVE-2018-12609 | Med | 0.42 | 6.5 | 0.01 | Jan 30, 2019 | OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. | ||
| CVE-2023-24602 | Med | 0.40 | 6.1 | 0.00 | May 29, 2023 | OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title. | ||
| CVE-2023-24601 | Med | 0.40 | 6.1 | 0.00 | May 29, 2023 | OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree. | ||
| CVE-2022-37306 | Med | 0.40 | 6.1 | 0.01 | Apr 16, 2023 | OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. | ||
| CVE-2022-43697 | Med | 0.40 | 6.1 | 0.00 | Apr 15, 2023 | OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. | ||
| CVE-2022-43696 | Med | 0.40 | 6.1 | 0.00 | Apr 15, 2023 | OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. | ||
| CVE-2022-37310 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI. | ||
| CVE-2022-37307 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. | ||
| CVE-2022-31469 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. | ||
| CVE-2022-31468 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2022 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. | ||
| CVE-2022-23101 | Med | 0.40 | 6.1 | 0.01 | Jul 27, 2022 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. | ||
| CVE-2021-44213 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | ||
| CVE-2021-44212 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | ||
| CVE-2021-44210 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | ||
| CVE-2021-44209 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. |
- risk 0.42cvss 6.5epss 0.01
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
- risk 0.42cvss 6.5epss 0.03
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
- risk 0.42cvss 6.5epss 0.01
OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
- risk 0.42cvss 6.5epss 0.01
OX App Suite through 7.10.3 allows SSRF.
- risk 0.42cvss 6.5epss 0.01
OX App Suite through 7.10.3 allows XXE attacks.
- risk 0.42cvss 6.5epss 0.01
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
- risk 0.40cvss 6.1epss 0.00
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
- risk 0.40cvss 6.1epss 0.00
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
- risk 0.40cvss 6.1epss 0.01
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
- risk 0.40cvss 6.1epss 0.00
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
- risk 0.40cvss 6.1epss 0.00
OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
Page 2 of 5