Appsuite
by Open-Xchange
CVEs (218)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-37312 | 0.00 | — | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. | |||
| CVE-2022-31469 | 0.00 | — | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. | |||
| CVE-2022-37308 | 0.00 | — | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. | |||
| CVE-2022-37307 | 0.00 | — | 0.01 | Dec 26, 2022 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. | |||
| CVE-2022-29851 | 0.00 | — | 0.04 | Oct 24, 2022 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document. | |||
| CVE-2022-31468 | 0.00 | — | 0.00 | Oct 24, 2022 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. | |||
| CVE-2022-24406 | 0.00 | — | 0.01 | Jul 27, 2022 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | |||
| CVE-2022-23101 | 0.00 | — | 0.01 | Jul 27, 2022 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. | |||
| CVE-2022-23099 | 0.00 | — | 0.01 | Jul 27, 2022 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. | |||
| CVE-2021-44213 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | |||
| CVE-2021-44212 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | |||
| CVE-2021-44211 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. | |||
| CVE-2021-44210 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | |||
| CVE-2021-44209 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. | |||
| CVE-2021-44208 | 0.00 | — | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat. | |||
| CVE-2021-38378 | 0.00 | — | 0.01 | Nov 22, 2021 | OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. | |||
| CVE-2021-38377 | 0.00 | — | 0.01 | Nov 22, 2021 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. | |||
| CVE-2021-38376 | 0.00 | — | 0.01 | Nov 22, 2021 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | |||
| CVE-2021-38375 | 0.00 | — | 0.01 | Nov 22, 2021 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. | |||
| CVE-2021-33495 | 0.00 | — | 0.01 | Nov 22, 2021 | OX App Suite 7.10.5 allows XSS via an OX Chat system message. |
- CVE-2022-37312Dec 26, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
- CVE-2022-31469Dec 26, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
- CVE-2022-37308Dec 26, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
- CVE-2022-37307Dec 26, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
- CVE-2022-29851Oct 24, 2022risk 0.00cvss —epss 0.04
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
- CVE-2022-31468Oct 24, 2022risk 0.00cvss —epss 0.00
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
- CVE-2022-24406Jul 27, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
- CVE-2022-23101Jul 27, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
- CVE-2022-23099Jul 27, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
- CVE-2021-44213Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
- CVE-2021-44212Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
- CVE-2021-44211Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
- CVE-2021-44210Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
- CVE-2021-44209Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
- CVE-2021-44208Mar 28, 2022risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
- CVE-2021-38378Nov 22, 2021risk 0.00cvss —epss 0.01
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.
- CVE-2021-38377Nov 22, 2021risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
- CVE-2021-38376Nov 22, 2021risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
- CVE-2021-38375Nov 22, 2021risk 0.00cvss —epss 0.01
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
- CVE-2021-33495Nov 22, 2021risk 0.00cvss —epss 0.01
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
Page 6 of 11