1311 matches found
CVE-2020-15003
OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user via the session API during shared Drive access...
Cross site scripting
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
CVE-2020-15002
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
Spoofing
OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user via the session API during shared Drive access...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
Server side request forgery (ssrf)
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
CVE-2020-15004
CVE-2020-15004 affects Open-Xchange OX App Suite (backend) up to versions 7.10.3. The vulnerability is a Cross-Site Scripting issue in a diagnostics servlet that returns the raw HTTP GET content, enabling injection of malicious JavaScript. Access is unauthenticated by default, but not exposed on ...
CVE-2020-15003
OX App Suite (backend) up to version 7.10.3 contains an information disclosure vulnerability where a user can obtain the IP address and User-Agent string of another user via the session API during shared Drive access. Root cause involves exposure through the session API during Drive sharing, enab...
CVE-2020-15002
CVE-2020-15002 is an SSRF vulnerability in Open-Xchange OX App Suite (and OX Documents) up to version 7.10.3, exploitable via the /ajax/messaging/message API. The issue enables an attacker to trigger server-side requests (blind SSRF) through crafted interactions, with the exploit discussion showi...
CVE-2020-15002
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API...
Open-Xchange: XSS - Notes - Attribute injection through overlapping tags
The Notes app uses simple markup language to format the content, which is later converted to HTML for display. javascript // frontend/ui/apps/io.ox/notes/parser.js parsePlainText: function text var lines = .escapetext.split/\n/, openList; ... var html = lines.join'' .replace/!\.?/g, ''...
CVE-2020-12643
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
CVE-2020-12644
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
CVE-2020-12646
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
CVE-2020-12643
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...