1686 matches found
Design/Logic Flaw
OX App Suite through 7.10.4 allows XSS via an inline binary file...
Design/Logic Flaw
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...
Design/Logic Flaw
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...
Design/Logic Flaw
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI...
Code injection
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code...
Design/Logic Flaw
OX App Suite through 7.10.4 allows XSS via the subject of a task...
CVE-2021-23932
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename...
CVE-2021-23931
OX App Suite through 7.10.4 allows XSS via an inline binary file...
Code injection
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code...
Cross site scripting
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename...
CVE-2021-23933
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL...
CVE-2021-23929
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI...
CVE-2021-23936
OX App Suite through 7.10.4 allows XSS via the subject of a task...
CVE-2021-23935
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code...
Design/Logic Flaw
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile...
CVE-2021-23927
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...
CVE-2021-23934
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code...
CVE-2021-23927
OX App Suite up to version 7.10.4 is vulnerable to server-side request forgery (SSRF) when a URL containing an @ character is used in a PUT request to appsuite/api/oauth/proxy. The root cause is described as an SSRF flaw in the handling of such URLs, exposing potential unintended requests from th...
CVE-2021-23927
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...
CVE-2021-23928
OX App Suite up to 7.10.3 is affected by a cross-site scripting vulnerability via the ajax/apps/manifests query string. The description in multiple sources states XSS can be triggered through that parameter, enabling script execution in the victim’s browser. CVSS data in the sources show MEDIUM s...