CVE-2022-43696

OX App Suite before 7.10.6-rev20 allows XSS via upsell ads...

Server side request forgery (ssrf)

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

Cross site scripting

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

Design/Logic Flaw

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...

CVE-2022-43696

OX App Suite before 7.10.6-rev20 allows XSS via upsell ads...

CVE-2022-43697

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

CVE-2022-43697

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

CVE-2022-43698

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

CVE-2022-43699

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...

CVE-2022-43698

Open-Xchange OX App Suite prior to version 7.10.6-rev30 is affected by an SSRF vulnerability: modifying a POP3 account can bypass the deny-list, enabling potential unauthorized requests within the application. The issue is documented across multiple feeds (NVD/Red Hat/OSV/etc.) with the same desc...

PT-2023-14290 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for Server-Side Request Forgery SSRF because changing a POP3 account disregards the deny-list. This occurs when the OX App Suite is configured to use POP3 accounts and ...

CVE-2022-43698

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

PT-2023-14289 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for cross-site scripting XSS via an activity tracking adapter defined by jslob. This can potentially lead to malicious script execution on the client-side...

CVE-2022-43697

OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob...

CVE-2022-43697

OX App Suite (Open-Xchange) prior to 7.10.6-rev30 is vulnerable to cross-site scripting via an activity tracking adapter defined by jslob. The root cause is an XSS flaw in how the adapter processes input, enabling injected scripts to run in the client when the affected interface is used. Affected...

CVE-2022-43698

OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list...

CVE-2022-43696

CVE-2022-43696 affects Open-Xchange OX App Suite prior to 7.10.6-rev20 , where XSS via upsell ads is possible. The vulnerability concerns the web UI component handling upsell ads, enabling cross-site scripting. According to PT-2023-14288 and multiple CVE aggregations, the recommended remediation ...

CVE-2022-43699

OX App Suite prior to 7.10.6-rev30 is affected by a server-side request forgery (SSRF) vulnerability stemming from email account discovery ignoring the deny-list, allowing an attacker who controls DNS for an external domain (present in the host part of an email address) to trigger SSRF. Affected ...

CVE-2022-43696

OX App Suite before 7.10.6-rev20 allows XSS via upsell ads...

CVE-2022-43699

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...