Priority LOW 12
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
CVSS 3.1LOW 2.6· Network · Low privileges · User interaction · EPSS 0.0014 · Published 2026-03-22 · Fixed in 5.12.5 CWE-308
Priority LOW 27
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00143 · Published 2026-03-22 · Fixed in 5.12.5 CWE-79
Priority MEDIUM 57
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00454 · Published 2026-02-24 · No fix listed CWE-79
Priority MEDIUM 60
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00318 · Published 2025-12-04 · No fix listed CWE-79
Priority MEDIUM 60
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00305 · Published 2025-11-24 · No fix listed CWE-79
Priority LOW 28
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00483 · Published 2024-09-09 · No fix listed CWE-79
Priority LOW 27
Alinto SOGo through 5.10.0 allows XSS during attachment preview.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00348 · Published 2024-05-04 · No fix listed CWE-79
Priority LOW 29
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01031 · Published 2024-01-16 · No fix listed CWE-79
Priority LOW 28
A vulnerability was found in Alinto SOGo up to 5.7.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00612 · Published 2022-12-16 · No fix listed CWE-707
Priority LOW 28
A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00612 · Published 2022-12-16 · No fix listed CWE-707
Priority MEDIUM 40
Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00894 · Published 2017-09-20 · No fix listed CWE-352
Priority LOW 30
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01203 · Published 2017-02-17 · No fix listed CWE-79
Priority LOW 23
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01412 · Published 2017-02-17 · No fix listed CWE-184
Priority LOW 30
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01223 · Published 2017-02-17 · No fix listed CWE-79
Priority LOW 33
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02156 · Published 2017-02-03 · No fix listed CWE-399
THREATIST.IORead the docs