Cross site scripting

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...

CVE-2022-37306

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...

CVE-2022-37306

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...

CVE-2022-37306

OX App Suite (Open-Xchange) vulnerable before 7.10.6-rev30 to cross-site scripting via an upsell trigger. Affected file/component: OX App Suite web interface; root cause: improper sanitization in upsell-trigger handling leading to XSS. Versions prior to 7.10.6-rev30 are impacted; update to 7.10.6...

CVE-2022-37306

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...

PT-2023-13526 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for XSS via an upsell trigger. Recommendations: For versions prior to 7.10.6-rev30, update to version 7.10.6-rev30 or later to resolve the issue...

CVE-2022-37306: Improper Neutralization of Input During Web Page Generation

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...

CVE-2022-43697

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

CVE-2022-43698

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

CVE-2022-43696

OX App Suite before 7.10.6-rev20 allows XSS via upsell ads...

Server side request forgery (ssrf)

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

Design/Logic Flaw

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...

Cross site scripting

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

PT-2023-14290 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for Server-Side Request Forgery SSRF because changing a POP3 account disregards the deny-list. This occurs when the OX App Suite is configured to use POP3 accounts and ...

CVE-2022-43698

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

CVE-2022-43699

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...

CVE-2022-43697

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

PT-2023-14289 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for cross-site scripting XSS via an activity tracking adapter defined by jslob. This can potentially lead to malicious script execution on the client-side...

CVE-2022-43697: Improper Neutralization of Input During Web Page Generation

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

CVE-2022-43697

OX App Suite (Open-Xchange) prior to 7.10.6-rev30 is vulnerable to cross-site scripting via an activity tracking adapter defined by jslob. The root cause is an XSS flaw in how the adapter processes input, enabling injected scripts to run in the client when the affected interface is used. Affected...