Server side request forgery (ssrf)

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring...

CVE-2020-24701

CVE-2020-24701 affects OX App Suite up to version 7.10.4. The issue is a Cross-Site Scripting (XSS) via the app loading mechanism, exploiting PATH_INFO to the /appsuite URI. This allows injection of JavaScript by an attacker, with potential impact including theft of session cookies and actions on...

CVE-2020-24700

OX App Suite (Open-Xchange) up to 7.10.3 is affected by a Server-Side Request Forgery (SSRF) in the backend where GET requests to arbitrary domains can be triggered via an initial autoconfig substring. The issue is documented across multiple sources (NVD, Red Hat, PacketStorm) and centers on the ...

CVE-2020-24700

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring...

CVE-2020-24701: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI...

CVE-2021-23934: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code...

CVE-2021-23929: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/ ?delivery=view URI...

CVE-2021-23928: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...

CVE-2020-24700: Server-Side Request Forgery (SSRF)

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring...

PT-2021-15613

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for Server-Side Request Forgery SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. This can potentially be exploited by sending a crafted reque...

PT-2021-15618

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for cross-site scripting XSS attacks via an inline image with a crafted filename. This means an attacker could potentially inject malicious scripts into a website, affecti...

PT-2021-15622

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for cross-site scripting XSS attacks via the subject of a task. This means an attacker could potentially inject malicious scripts into the task subject, which would then b...

PT-2021-15621

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for cross-site scripting XSS attacks via an appointment where the location contains JavaScript code. This can potentially lead to the execution of malicious scripts on the...

PT-2021-15614

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.4 Description: The issue allows for XSS via the ajax/apps/manifests query string. Recommendations: For OX App Suite versions prior to 7.10.4, update to version 7.10.4 or later to resolve the issue...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.3 and earlier versions. The vulnerability can be exploited by an attacker to conduct a cross-site...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct cross-site scripting attacks by using th...

CVE-2021-23931: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via an inline binary file...

CVE-2021-23930: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile...

CVE-2021-23936: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via the subject of a task...

CVE-2021-23935: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code...