Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements

Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked

Requests to cache an image could be abused to include SQL queries that would be executed unchecked

Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context

Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources

Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code

Documents operations could be manipulated to contain invalid data types, possibly script code

Users were able to set an arbitrary "product name" for OX Guard

The "OX Count" web service did not specify a media-type when processing responses by external resources

The "OX Chat" web service did not specify a media-type when processing responses by external resources

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers

The "upsell" widget for the portal allows to specify a product description

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login

Control characters were not removed when exporting user feedback content

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents

Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules

When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes

When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes

When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes

IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made

Default permissions for a properties file were too permissive

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache