Priority HIGH 78
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.7066 · Published 2024-05-14 · Partial fix · 126, 115.11 +1 CWE-754
Priority MEDIUM 63
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0073 · Published 2022-12-26 · No fix listed CWE-918
Priority MEDIUM 63
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0097 · Published 2022-12-26 · No fix listed CWE-1284
Priority MEDIUM 63
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0097 · Published 2022-12-26 · No fix listed CWE-1284
Priority MEDIUM 60
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00565 · Published 2022-12-26 · No fix listed CWE-79
Priority MEDIUM 60
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00565 · Published 2022-12-26 · No fix listed CWE-79
Priority MEDIUM 60
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00565 · Published 2022-12-26 · No fix listed CWE-79
Priority MEDIUM 60
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0057 · Published 2022-12-26 · No fix listed CWE-79
Priority MEDIUM 60
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00568 · Published 2023-04-16 · No fix listed CWE-79
Priority MEDIUM 60
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00565 · Published 2022-12-26 · No fix listed CWE-79
Priority MEDIUM 55
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0381 · Published 2022-10-24 · No fix listed CWE-78
Priority MEDIUM 48
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03142 · Published 2022-07-27 · No fix listed CWE-78
Priority MEDIUM 48
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02996 · Published 2022-07-27 · No fix listed CWE-78
Priority MEDIUM 45
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01668 · Published 2024-01-08 · No fix listed CWE-90
Priority MEDIUM 45
OX App Suite 7.10.0 and earlier has Incorrect Access Control.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01523 · Published 2019-06-17 · No fix listed
Priority MEDIUM 45
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04473 · Published 2018-06-15 · No fix listed CWE-918
Priority MEDIUM 45
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01227 · Published 2019-05-23 · No fix listed CWE-275
Priority MEDIUM 45
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01388 · Published 2019-05-22 · No fix listed CWE-284
Priority MEDIUM 45
Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01388 · Published 2019-05-23 · No fix listed CWE-284
Priority MEDIUM 45
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01388 · Published 2019-05-23 · No fix listed CWE-200
Priority MEDIUM 44
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00819 · Published 2023-08-02 · No fix listed CWE-89
Priority MEDIUM 44
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01075 · Published 2020-08-31 · No fix listed CWE-307
Priority MEDIUM 44
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVSS 3.0CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00886 · Published 2019-05-23 · No fix listed CWE-918
Priority MEDIUM 43
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0133 · Published 2024-01-08 · No fix listed CWE-78
Priority MEDIUM 43
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.07294 · Published 2018-09-11 · No fix listed CWE-20
Load more
THREATIST.IORead the docs