CVE-2020-28945: Improper Neutralization of Input During Web Page Generation

OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as !http://onerror=Function.constructor, in a Notes item...

CVE-2020-28943

OX App Suite 7.10.4 and earlier allows SSRF via a snippet...

CVE-2020-28944

OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data...

CVE-2021-31934

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object payload in the position or company field that is mishandled in the App Suite UI on a smartphone...

CVE-2020-28943

OX App Suite 7.10.4 and earlier allows SSRF via a snippet...

CVE-2021-31934

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object payload in the position or company field that is mishandled in the App Suite UI on a smartphone...

CVE-2021-31935

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

CVE-2020-28944

OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data...

CVE-2021-31935

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

Server side request forgery (ssrf)

OX App Suite 7.10.4 and earlier allows SSRF via a snippet...

CVE-2021-31934

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object payload in the position or company field that is mishandled in the App Suite UI on a smartphone...

Cross site scripting

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object payload in the position or company field that is mishandled in the App Suite UI on a smartphone...

Cross site scripting

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

Code injection

OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data...

CVE-2021-31934

OX App Suite 7.10.4 and earlier is affected by a Cross-Site Scripting (XSS) vulnerability in the UI on smartphones, triggered by a crafted contact object in which payloads placed in the position or company fields are mishandled. The issue is confirmed across multiple sources (NVD, Red Hat, CNVD, ...

CVE-2021-31934

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object payload in the position or company field that is mishandled in the App Suite UI on a smartphone...

CVE-2021-31935

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list payload in the common name that is mishandled in the scheduling view...

CVE-2021-31935

OX App Suite 7.10.4 and earlier is vulnerable to Cross-Site Scripting via a crafted distribution list, where the payload in the distribution list’s common name is mishandled in the scheduling view. This vulnerability is described consistently across CVE-2021-31935 records (NVD, Red Hat, CNVD, CVE...

CVE-2020-28944

OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data...

CVE-2020-28944

CVE-2020-28944 affects Open-Xchange/OX App Suite (OX Guard) prior to fixes. The connected packetstorm entry confirms vulnerable product/version: OX App Suite 7.10.4 and earlier with a Denial of Service via a WKS server that responds slowly or with large data volumes. The vulnerability affects the...