CVE-2021-33489

OX App Suite (Open-Xchange) 7.10.x suffers a cross-site scripting vulnerability (CVE-2021-33489) via JavaScript in shared XCF files. The root cause is a sanitization bypass for certain image formats in which HTML/JS can be injected and executed in a user’s context. Affected versions are 7.10.5 an...

OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal

Product: OX App Suite, OX Documents Vendor: OX Software GmbH Internal reference: MWB-993 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.5 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev35,...