OA
Product
OX App Suite
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 20Low 3
Watch
Add OX App Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-26428 | 6.5 | Jun 20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context Affected: through 7.10.6-rev39; through 8.9 |
| CVE-2023-29043 | 6.1 | Nov 2 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document Affected: through 7.10.6-rev7 |
| CVE-2023-26441 | 5.5 | Aug 2 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources Affected: through 8.10 |
| CVE-2023-29045 | 5.4 | Nov 2 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code Affected: through 7.10.6-rev7 |
| CVE-2023-29044 | 5.4 | Nov 2 | Documents operations could be manipulated to contain invalid data types, possibly script code Affected: through 7.10.6-rev7 |
| CVE-2023-26456 | 5.4 | Nov 2 | Users were able to set an arbitrary "product name" for OX Guard Affected: through 2.10.7-rev6 |
| CVE-2023-26450 | 5.4 | Aug 2 | The "OX Count" web service did not specify a media-type when processing responses by external resources Affected: through 7.10.6-rev27 |
| CVE-2023-26449 | 5.4 | Aug 2 | The "OX Chat" web service did not specify a media-type when processing responses by external resources Affected: through 7.10.6-rev27 |
| CVE-2023-26448 | 5.4 | Aug 2 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers Affected: through 7.10.6-rev27 |
| CVE-2023-26447 | 5.4 | Aug 2 | The "upsell" widget for the portal allows to specify a product description Affected: through 7.10.6-rev27 |
| CVE-2023-26446 | 5.4 | Aug 2 | The users clientID at "application passwords" was not sanitized or escaped before being added to DOM Affected: through 7.10.6-rev27; through 8.11 |
| CVE-2023-26445 | 5.4 | Aug 2 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login Affected: through 7.10.6-rev27 |
| CVE-2023-26429 | 5.3 | Jun 20 | Control characters were not removed when exporting user feedback content Affected: through 7.10.6-rev39; through 8.10 |
| CVE-2023-26435 | 5.0 | Jun 20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents Affected: through 7.10.6-rev7 |
| CVE-2023-29046 | 4.3 | Nov 2 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged Affected: through 7.10.6-rev48; through 8.11 |
| CVE-2023-26430 | 4.3 | Aug 2 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules Affected: through 7.10.6-rev42; through 8.10 |
| CVE-2023-26434 | 4.3 | Jun 20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes Affected: through 7.10.6-rev39 |
| CVE-2023-26433 | 4.3 | Jun 20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes Affected: through 7.10.6-rev39; through 8.10 |
| CVE-2023-26432 | 4.3 | Jun 20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes Affected: through 7.10.6-rev39; through 8.10 |
| CVE-2023-26431 | 4.3 | Jun 20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made Affected: through 7.10.6-rev39; through 8.10 |
Showing 20