Vulnerabilities

References to the "app loader" functionality could contain redirects to unexpected locations.

Processing of user-defined mail search expressions is not limited.

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.

Processing of user-defined DAV user-agent strings is not limited.

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.

User ID references at mentions in document comments were not correctly sanitized.

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements.

Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged.

Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.

Documents operations could be manipulated to contain invalid data types, possibly script code.

Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document.

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer.

Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked.

Requests to cache an image could be abused to include SQL queries that would be executed unchecked.

Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked.

OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.

OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.

OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.

OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.

OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.

OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.