Vulnerabilities

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.

The "OX Count" web service did not specify a media-type when processing responses by external resources.

The "OX Chat" web service did not specify a media-type when processing responses by external resources.

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers.

The "upsell" widget for the portal allows to specify a product description.

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login.

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements.

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources.

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups.

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement.

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache.

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules.