1686 matches found
Cross site scripting
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
Server side request forgery (ssrf)
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
Spoofing
OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user via the session API during shared Drive access...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
CVE-2020-15004
CVE-2020-15004 affects Open-Xchange OX App Suite (backend) up to versions 7.10.3. The vulnerability is a Cross-Site Scripting issue in a diagnostics servlet that returns the raw HTTP GET content, enabling injection of malicious JavaScript. Access is unauthenticated by default, but not exposed on ...
CVE-2020-15003
OX App Suite (backend) up to version 7.10.3 contains an information disclosure vulnerability where a user can obtain the IP address and User-Agent string of another user via the session API during shared Drive access. Root cause involves exposure through the session API during Drive sharing, enab...
CVE-2020-15002
CVE-2020-15002 is an SSRF vulnerability in Open-Xchange OX App Suite (and OX Documents) up to version 7.10.3, exploitable via the /ajax/messaging/message API. The issue enables an attacker to trigger server-side requests (blind SSRF) through crafted interactions, with the exploit discussion showi...
CVE-2020-15002
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
CVE-2020-15002: Server-Side Request Forgery (SSRF)
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
PT-2020-14111
Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.4 Description The issue allows for Server-Side Request Forgery SSRF via the /ajax/messaging/message API endpoint. This could potentially be exploited to access internal resources. Recommendations For OX App...
PT-2020-14113
Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.4 Description The issue allows for XSS in the stats/diagnostic endpoint, specifically when the param variable is used. This could potentially lead to malicious script execution. Recommendations For OX App...
PT-2020-14112
Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.3 and earlier Description The issue allows a user to obtain the IP address and User-Agent string of another user through the session API during shared Drive access. Recommendations For OX App Suite versions 7.10.3 an...
CVE-2020-15003: Undefined Security Weakness
OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user via the session API during shared Drive access...
CVE-2020-15004: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
Open-Xchange: XSS - Notes - Attribute injection through overlapping tags
The Notes app uses simple markup language to format the content, which is later converted to HTML for display. javascript // frontend/ui/apps/io.ox/notes/parser.js parsePlainText: function text var lines = .escapetext.split/\n/, openList; ... var html = lines.join'' .replace/!\.?/g, ''...
CVE-2020-12643
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...