CVE-2022-37309

OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name...

CVE-2022-37310

OX App Suite 7.10.6 and earlier is affected by a Cross‑Site Scripting (XSS) vulnerability introduced via a malicious capability to the metrics or help module, exploitable through a URI like /#!!&app=io.ox/files&cap=. Impact cited includes execution of script in the victim’s context and potential ...

CVE-2022-37308

OX App Suite (Open-Xchange) is affected up to version 7.10.6 with a cross-site scripting (XSS) issue triggered by HTML in text/plain email messages. The root cause involves HTML content in plain-text emails being processed in the client, enabling script execution. Remediation available in fixed b...

CVE-2022-29853

OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message...

CVE-2022-37309

OX App Suite (Open-Xchange)

PT-2022-23918 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for XSS via a malicious capability to the metrics or help module. This can be demonstrated by a URI such as "/!!&app=io.ox/files&cap=". Recommendations: For versions 7.10....

CVE-2022-37312

OX App Suite up to version 7.10.6 is affected by an Uncontrolled Resource Consumption vulnerability triggered by a large request body containing a redirect URL to the deferrer servlet. Reported impact: memory/resource exhaustion with availability impact. Public remediation guidance varies: PT Sec...

CVE-2022-37307

OX App Suite up to version 7.10.6 is affected by a cross-site scripting (XSS) vulnerability (CVE-2022-37307) that can be triggered via XHTML CDATA in a snippet, demonstrated by the onerror attribute of an IMG element in an email signature. The root cause is an injection possibility in the fronten...

CVE-2022-37307

OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature...

CVE-2022-29852

CVE-2022-29852 affects Open-Xchange OX App Suite up to version 8.2. The issue is an XSS vulnerability caused by BMFreehand10 and image/x-freehand not being blocked, enabling cross-site scripting. No exploitation details are provided in the sources beyond this description. Mitigation found in a re...

CVE-2022-31469

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

CVE-2022-29853

OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message...

PT-2022-23915 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for cross-site scripting XSS attacks via HTML in text/plain e-mail messages. This can potentially lead to the execution of malicious scripts on the client-side...

CVE-2022-37308

OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages...

PT-2022-23919 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue is related to Uncontrolled Resource Consumption. This occurs when a large location request parameter is sent to the redirect servlet, potentially causing the system to consume...

CVE-2022-29852

OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked...

CVE-2022-37311

OX App Suite up to version 7.10.6 is affected by CVE-2022-37311 due to Uncontrolled Resource Consumption caused by a large location request parameter to the redirect servlet. The vulnerability, as described in multiple sources, can lead to memory/resource exhaustion. Affected software is Open-Xch...

CVE-2022-37313

OX App Suite up to version 7.10.6 is affected by SSRF due to anti-SSRF protection only validating the first DNS AA/AAAA record. This can allow server-side requests to unintended internal resources. Remediation per the sources: upgrade to fixed builds such as 7.10.6-rev16 or 7.10.5-rev37 (or newer...

CVE-2022-37312

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet...

CVE-2022-31469

OX App Suite (v7.10.6 and earlier) is affected by a Cross-Site Scripting (XSS) vulnerability via deep links in emails. The root cause is a detection mechanism for deep links that can be exploited by injecting references to arbitrary fake applications (e.g., a /#!!&app=.%2e./ URI), enabling script...