1686 matches found
CVE-2020-12643
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
CVE-2020-12644
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
Design/Logic Flaw
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
Cross site scripting
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
Server side request forgery (ssrf)
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
Input validation
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
CVE-2020-12646
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
CVE-2020-12646
OX App Suite 7.10.3 and earlier is affected by an XSS vulnerability in OX Documents (backend) triggered via content types text/x-javascript, text/rdf, or a PDF. The root cause is incomplete input filtering related to legacy media types, as described in the public advisory. Impact is cross-site sc...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
CVE-2020-12645
CVE-2020-12645 affects OX App Suite 7.10.1–7.10.3. The root cause is improper input validation for rate limits, manifested via crafted User-Agent headers, spoofed vacation notices, and memory consumption in /apps/load. Documented impact is memory/resource exhaustion with potential service impact,...
CVE-2020-12644
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
CVE-2020-12644
CVE-2020-12644 affects OX App Suite 7.10.3 and earlier. The issue is a server-side request forgery (SSRF) related to the mail account API and the /folder/list endpoint, enabling network-access from the vulnerable system. CVSS data indicates a Network attack vector with Low complexity and Privileg...
CVE-2020-12643
CVE-2020-12643 affects OX App Suite 7.10.3 and earlier. The flaw is an incorrect access control in the /api/subscriptions path that can disclose the email address contained in a snippet when requested from another user, due to an improper permission check. Impact is exposure of email addresses; n...
CVE-2020-12643: Authorization Bypass Through User-Controlled Key
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
PT-2020-13183
Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.1 through 7.10.3 Description The issue is related to improper input validation for rate limits, which can be exploited with a crafted User-Agent header. Additionally, it involves spoofed vacation notices and excessiv...
CVE-2020-12644: Server-Side Request Forgery (SSRF)
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
PT-2020-13181
Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.3 and earlier Description The issue is related to Incorrect Access Control. It can be exploited via an "/api/subscriptions" request for a snippet containing an email address. Recommendations For OX App Suite versions...
PT-2020-13182
Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.3 and earlier Description The issue allows Server-Side Request Forgery SSRF and is related to the mail account API and the "/folder/list" API endpoint. This means an attacker could potentially forge requests that the...