1311 matches found
Cross site scripting
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
Design/Logic Flaw
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address...
Server side request forgery (ssrf)
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
CVE-2020-12646
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
CVE-2020-12646
OX App Suite 7.10.3 and earlier is affected by an XSS vulnerability in OX Documents (backend) triggered via content types text/x-javascript, text/rdf, or a PDF. The root cause is incomplete input filtering related to legacy media types, as described in the public advisory. Impact is cross-site sc...
CVE-2020-12645
CVE-2020-12645 affects OX App Suite 7.10.1–7.10.3. The root cause is improper input validation for rate limits, manifested via crafted User-Agent headers, spoofed vacation notices, and memory consumption in /apps/load. Documented impact is memory/resource exhaustion with potential service impact,...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
CVE-2020-12644
CVE-2020-12644 affects OX App Suite 7.10.3 and earlier. The issue is a server-side request forgery (SSRF) related to the mail account API and the /folder/list endpoint, enabling network-access from the vulnerable system. CVSS data indicates a Network attack vector with Low complexity and Privileg...
CVE-2020-12644
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API...
CVE-2020-12643
CVE-2020-12643 affects OX App Suite 7.10.3 and earlier. The flaw is an incorrect access control in the /api/subscriptions path that can disclose the email address contained in a snippet when requested from another user, due to an improper permission check. Impact is exposure of email addresses; n...
OX App Suite / OX Documents XSS / SSRF / Bypass
Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange GmbH...
Open-Xchange OX App Suite code issue vulnerability (CNVD-2020-52698)
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A code issue vulnerability exists in Open-Xchange OX App Suite 7.10.3 and prior versions. An attacker could exploit...
Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2020-52700)
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.3 and earlier. The...
Open-Xchange OX App Suite Resource Management Error Vulnerability
Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A resource management error vulnerability exists in Open-Xchange OX App Suite 7.10.3 and prior versions. A remote...
CVE-2020-8543
OX App Suite through 7.10.3 has Improper Input Validation...
CVE-2020-8541
OX App Suite through 7.10.3 allows XXE attacks...
CVE-2020-8543
OX App Suite through 7.10.3 has Improper Input Validation...
CVE-2020-8542
OX App Suite through 7.10.3 allows XSS...