CVE-2021-23932

OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename...

CVE-2021-23929

OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI...

CVE-2021-23927

OX App Suite up to version 7.10.4 is vulnerable to server-side request forgery (SSRF) when a URL containing an @ character is used in a PUT request to appsuite/api/oauth/proxy. The root cause is described as an SSRF flaw in the handling of such URLs, exposing potential unintended requests from th...

CVE-2021-23927

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

CVE-2021-23928

OX App Suite up to 7.10.3 is affected by a cross-site scripting vulnerability via the ajax/apps/manifests query string. The description in multiple sources states XSS can be triggered through that parameter, enabling script execution in the victim’s browser. CVSS data in the sources show MEDIUM s...

CVE-2021-23928

OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...

CVE-2021-23929

CVE-2021-23929 affects OX App Suite up to version 7.10.4. The issue is a cross-site scripting (XSS) vulnerability caused by a crafted Content-Disposition header in an HTML document uploaded to the URI ajax/share/?delivery=view. This header-based payload can lead to script execution in the context...

CVE-2021-23929

OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI...

CVE-2021-23930

CVE-2021-23930 affects OX App Suite up to version 7.10.4, with an XSS vulnerability exploitable via the transformation/conversion API used for a distributedFile. The connected records corroborate the issue across multiple feeds (Red Hat, CNVD, NVD, etc.). The provided documents do not specify an ...

CVE-2021-23930

OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile...

CVE-2021-23931

OX App Suite (version up to 7.10.4) is affected by a cross-site scripting (XSS) vulnerability in the web UI, exploitable via an inline binary file. The issue is described as XSS via an inline binary file affecting OX App Suite 7.10.4, with no explicit exploitation details or remediation steps pro...

CVE-2021-23931

OX App Suite through 7.10.4 allows XSS via an inline binary file...

CVE-2021-23932

CVE-2021-23932 corresponds to an XSS vulnerability in OX App Suite up to version 7.10.4, exploitable via an inline image with a crafted filename. The connected sources confirm the vulnerability description and affected product, but do not provide any remediation details (e.g., patched version) wi...

CVE-2021-23932

OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename...

CVE-2021-23933

OX App Suite versions up to 7.10.4 are affected by an XSS in a Note referenced by a mail:// URL. The root cause relates to cross-site scripting via JavaScript in Note handling; affected component is the Note feature inside OX App Suite. Publicly documented impact indicates an XSS vulnerability wi...

CVE-2021-23934

OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code...

CVE-2021-23934

OX App Suite up to version 7.10.4 is vulnerable to a Cross-Site Scripting (XSS) issue that can be triggered by a contact name containing JavaScript code. This is documented across multiple sources in the connected set (e.g., CVE entry and CNVD/Red Hat entries). The available documents describe th...

CVE-2021-23935

OX App Suite (up to 7.10.4) contains a cross-site scripting (XSS) vulnerability exploited by placing JavaScript code in the location field of an appointment. This can lead to injected scripts being executed in a victim’s browser. Public details confirm the flaw and affected version; no patch/work...

CVE-2021-23935

OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code...

CVE-2021-23936

OX App Suite (affected up to version 7.10.4) contains a cross-site scripting vulnerability that can be triggered via the subject of a task. The issue is documented under CVE-2021-23936 and is corroborated by multiple sources in the connected documents (CNVD/CVE entries, Red Hat advisory, CVE list...