OA
Product
OX App Suite
48
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 2Medium 42Low 0
Watch
Add OX App Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29851 | 9.8 | Oct 24 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS… Affected: through 7.10.6 |
| CVE-2022-24405 | 9.8 | Jul 27 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API Affected: through 7.10.6 |
| CVE-2022-23100 | 9.8 | Jul 27 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment) Affected: through 7.10.6 |
| CVE-2023-29050 | 9.6 | Jan 8 | The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-29048 | 8.8 | Jan 8 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-29051 | 8.1 | Jan 8 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-24603 | 6.5 | May 29 | OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +32 more |
| CVE-2022-24406 | 6.5 | Jul 27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls Affected: through 7.10.6 |
| CVE-2021-33491 | 6.5 | Nov 22 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with… Affected: through 7.10.5 |
| CVE-2024-23187 | 6.1 | May 6 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option Affected: before 8.22 |
| CVE-2024-23186 | 6.1 | May 6 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices Affected: before 8.22 |
| CVE-2023-29049 | 6.1 | Jan 8 | The "upsell" widget at the portal page could be abused to inject arbitrary script code Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +29 more |
| CVE-2023-24602 | 6.1 | May 29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +19 more |
| CVE-2023-24601 | 6.1 | May 29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +19 more |
| CVE-2022-37306 | 6.1 | Apr 16 | OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +25 more |
| CVE-2022-43697 | 6.1 | Apr 15 | OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +25 more |
| CVE-2022-43696 | 6.1 | Apr 15 | OX App Suite before 7.10.6-rev20 allows XSS via upsell ads Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +25 more |
| CVE-2022-31468 | 6.1 | Oct 24 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter Affected: through 8.2 |
| CVE-2022-23101 | 6.1 | Jul 27 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message Affected: through 7.10.6 |
| CVE-2021-44213 | 6.1 | Mar 28 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message Affected: through 7.10.5 |
| CVE-2021-44212 | 6.1 | Mar 28 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring Affected: through 7.10.5 |
| CVE-2021-44210 | 6.1 | Mar 28 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data Affected: through 7.10.5 |
| CVE-2021-44209 | 6.1 | Mar 28 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO Affected: through 7.10.5 |
| CVE-2021-44208 | 6.1 | Mar 28 | OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat Affected: through 7.10.5 |
| CVE-2021-38377 | 6.1 | Nov 22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results Affected: through 7.10.5 |
| CVE-2021-38375 | 6.1 | Nov 22 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message Affected: through 7.10.5 |
| CVE-2021-33495 | 6.1 | Nov 22 | OX App Suite 7.10.5 allows XSS via an OX Chat system message Affected: 7.10.5 |
| CVE-2021-33494 | 6.1 | Nov 22 | OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering Affected: 7.10.5 |
| CVE-2021-33492 | 6.1 | Nov 22 | OX App Suite 7.10.5 allows XSS via an OX Chat room name Affected: 7.10.5 |
| CVE-2021-33490 | 6.1 | Nov 22 | OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature Affected: through 7.10.5 |
| CVE-2021-33489 | 6.1 | Nov 22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file Affected: through 7.10.5 |
| CVE-2021-33488 | 6.1 | Nov 22 | chat in OX App Suite 7.10.5 has Improper Input Validation Affected: through 7.10.5 |
| CVE-2021-33493 | 6.0 | Nov 22 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format Affected: through 7.10.5 |
| CVE-2023-41710 | 5.4 | Jan 8 | User-defined script code could be stored for a upsell related shop URL Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +30 more |
| CVE-2023-29052 | 5.4 | Jan 8 | Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly Affected: 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +29 more |
| CVE-2021-44211 | 5.4 | Mar 28 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature Affected: through 7.10.5 |
| CVE-2021-38374 | 5.4 | Nov 22 | OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL Affected: through 7.10.5 |
| CVE-2024-23193 | 5.3 | May 6 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account Affected: before 8.22 |
| CVE-2023-24597 | 5.3 | May 29 | OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +19 more |
| CVE-2021-38376 | 5.3 | Nov 22 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call Affected: through 7.10.5 |
| CVE-2023-24604 | 4.3 | May 29 | OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of… Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +33 more |
| CVE-2023-24600 | 4.3 | May 29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +32 more |
| CVE-2023-24599 | 4.3 | May 29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion." Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +32 more |
| CVE-2023-24598 | 4.3 | May 29 | OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +32 more |
| CVE-2022-43699 | 4.3 | Apr 15 | OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an… Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +25 more |
| CVE-2022-43698 | 4.3 | Apr 15 | OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +25 more |
| CVE-2021-38378 | 4.3 | Nov 22 | OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name Affected: through 7.10.5 |
| CVE-2023-24605 | 4.2 | May 29 | OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +32 more |
Showing 48