CVE-2022-37307

OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature...

CVE-2022-37308: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages...

CVE-2022-37312: Improper Validation of Specified Quantity in Input

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet...

CVE-2022-37312

OX App Suite up to version 7.10.6 is affected by an Uncontrolled Resource Consumption vulnerability triggered by a large request body containing a redirect URL to the deferrer servlet. Reported impact: memory/resource exhaustion with availability impact. Public remediation guidance varies: PT Sec...

CVE-2022-37313

OX App Suite up to version 7.10.6 is affected by SSRF due to anti-SSRF protection only validating the first DNS AA/AAAA record. This can allow server-side requests to unintended internal resources. Remediation per the sources: upgrade to fixed builds such as 7.10.6-rev16 or 7.10.5-rev37 (or newer...

CVE-2022-37307

OX App Suite up to version 7.10.6 is affected by a cross-site scripting (XSS) vulnerability (CVE-2022-37307) that can be triggered via XHTML CDATA in a snippet, demonstrated by the onerror attribute of an IMG element in an email signature. The root cause is an injection possibility in the fronten...

CVE-2022-29852

CVE-2022-29852 affects Open-Xchange OX App Suite up to version 8.2. The issue is an XSS vulnerability caused by BMFreehand10 and image/x-freehand not being blocked, enabling cross-site scripting. No exploitation details are provided in the sources beyond this description. Mitigation found in a re...

CVE-2022-37313: Server-Side Request Forgery (SSRF)

OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record...

CVE-2022-37311: Improper Validation of Specified Quantity in Input

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet...

CVE-2022-37309: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name...

PT-2022-23915 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for cross-site scripting XSS attacks via HTML in text/plain e-mail messages. This can potentially lead to the execution of malicious scripts on the client-side...

CVE-2022-29852

OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked...

CVE-2022-29852: Improper Neutralization of Input During Web Page Generation

OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked...

CVE-2022-29853: Improper Neutralization of Input During Web Page Generation

OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message...

CVE-2022-31469: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

CVE-2022-29853

Open-Xchange OX App Suite up to version 8.2 is affected by a cross-site scripting (XSS) vulnerability introduced by a complex hierarchy that forces the Show Entire Message feature for large HTML emails. The issue affects the web client component handling message rendering and can allow injected s...

CVE-2022-37311

OX App Suite up to version 7.10.6 is affected by CVE-2022-37311 due to Uncontrolled Resource Consumption caused by a large location request parameter to the redirect servlet. The vulnerability, as described in multiple sources, can lead to memory/resource exhaustion. Affected software is Open-Xch...

CVE-2022-37308

OX App Suite (Open-Xchange) is affected up to version 7.10.6 with a cross-site scripting (XSS) issue triggered by HTML in text/plain email messages. The root cause involves HTML content in plain-text emails being processed in the client, enabling script execution. Remediation available in fixed b...

CVE-2022-37309

OX App Suite (Open-Xchange)

PT-2022-19880 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions through 8.2 Description: The issue allows for XSS via a certain complex hierarchy that forces the use of Show Entire Message for a huge HTML e-mail message. Recommendations: For OX App Suite versions through 8.2, conside...