CVE-2022-23099

OX App Suite through 7.10.6 allows XSS by forcing block-wise read...

Cross site scripting

OX App Suite through 7.10.6 allows XSS by forcing block-wise read...

Command injection

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...

Command injection

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API...

Sql injection

OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls...

CVE-2022-24406

OX App Suite (Open-Xchange) up to version 7.10.6 is affected by an SSRF flaw where predictable multipart/form-data boundaries allow an attacker to inject into internal Documentconverter API calls. This can enable manipulation of internal API parameters and potentially compromise internal componen...

CVE-2022-24406

OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls...

CVE-2022-24405

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API...

CVE-2022-24405

OX App Suite (Open-Xchange) vulnerable through 7.10.6: OS command injection via a serialized Java class in the Documentconverter API. Affected versions are 7.10.6 and earlier; exploitation occurs when a Java-serialized object is processed by the documentconverter endpoint, enabling command execut...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23099

OX App Suite up to version 7.10.6 is affected by a cross-site scripting (XSS) vulnerability caused by forcing block-wise read, enabling script execution in the context of the affected application. Affected: OX App Suite 7.10.6 and earlier. Root cause: bypass of HTML cleanup/filtering via block-by...

CVE-2022-23099

OX App Suite through 7.10.6 allows XSS by forcing block-wise read...

CVE-2022-23100

CVE-2022-23100 affects Open-Xchange OX App Suite up to version 7.10.6, where the vulnerability exists in the Documentconverter component allowing OS command injection. An authenticated OX App Suite user can trigger a document conversion (e.g., via an email attachment or OX Drive content) and exec...

CVE-2022-23100

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...

PT-2022-16676 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for Server-Side Request Forgery SSRF due to predictable multipart/form-data boundaries, which can lead to injection into internal Documentconverter API calls...

PT-2022-16675 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows OS Command Injection via a serialized Java class to the "Documentconverter API" endpoint. This enables potential attackers to execute system commands. No information is...

CVE-2022-23100: Improper Neutralization of Special Elements used in an OS Command

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter e.g., through an email attachment...

CVE-2022-24405: Improper Neutralization of Special Elements used in an OS Command

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API...