Vulnerabilities

TI-2023-22127 CVE-2023-41708 · GHSA-jx74-v4wj-gvx2

Cross-site scripting in Open-Xchange GmbH OX App Suite

LOW 27

References to the "app loader" functionality could contain redirects to unexpected locations.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00475 Published 2024-02-12 No fix listed CWE-79

TI-2023-22126 CVE-2023-41707 · GHSA-f39x-gx7x-wwfj

LOW 30

Processing of user-defined mail search expressions is not limited.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00785 Published 2024-02-12 No fix listed CWE-400

TI-2023-22125 CVE-2023-41706 · GHSA-vw7m-6wwg-32mq

LOW 30

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00785 Published 2024-02-12 No fix listed CWE-400

TI-2023-22124 CVE-2023-41705 · GHSA-982m-cqw9-rvqf

LOW 30

Processing of user-defined DAV user-agent strings is not limited.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00785 Published 2024-02-12 No fix listed CWE-400

TI-2023-22123 CVE-2023-41704 · GHSA-g4pm-v5gm-7f4h

LOW 32

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00528 Published 2024-02-12 No fix listed CWE-79

TI-2023-22122 CVE-2023-41703 · GHSA-7cxw-p58p-m7w4

LOW 28

User ID references at mentions in document comments were not correctly sanitized.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00528 Published 2024-02-12 No fix listed CWE-79