OS
Vendor
OX Software GmbH
33
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-29047 | OA OX App Suite OX Software GmbH | 7.3 | Nov 2 | Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements |
| CVE-2023-29046 | OA OX App Suite OX Software GmbH | 4.3 | Nov 2 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged |
| CVE-2023-29045 | OA OX App Suite OX Software GmbH | 5.4 | Nov 2 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code |
| CVE-2023-29044 | OA OX App Suite OX Software GmbH | 5.4 | Nov 2 | Documents operations could be manipulated to contain invalid data types, possibly script code |
| CVE-2023-29043 | OA OX App Suite OX Software GmbH | 6.1 | Nov 2 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document |
| CVE-2023-26456 | OA OX App Suite OX Software GmbH | 5.4 | Nov 2 | Users were able to set an arbitrary "product name" for OX Guard |
| CVE-2023-26455 | OA OX App Suite OX Software GmbH | 7.8 | Nov 2 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer |
| CVE-2023-26454 | OA OX App Suite OX Software GmbH | 8.8 | Nov 2 | Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked |
| CVE-2023-26453 | OA OX App Suite OX Software GmbH | 8.8 | Nov 2 | Requests to cache an image could be abused to include SQL queries that would be executed unchecked |
| CVE-2023-26452 | OA OX App Suite OX Software GmbH | 8.8 | Nov 2 | Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked |
| CVE-2023-26451 | OA OX App Suite OX Software GmbH | 7.5 | Aug 2 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service |
| CVE-2023-26450 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | The "OX Count" web service did not specify a media-type when processing responses by external resources |
| CVE-2023-26449 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | The "OX Chat" web service did not specify a media-type when processing responses by external resources |
| CVE-2023-26448 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers |
| CVE-2023-26447 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | The "upsell" widget for the portal allows to specify a product description |
| CVE-2023-26446 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | The users clientID at "application passwords" was not sanitized or escaped before being added to DOM |
| CVE-2023-26445 | OA OX App Suite OX Software GmbH | 5.4 | Aug 2 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login |
| CVE-2023-26443 | OA OX App Suite OX Software GmbH | 9.8 | Aug 2 | Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements |
| CVE-2023-26442 | OA OX App Suite OX Software GmbH | 3.2 | Aug 2 | In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend |
| CVE-2023-26441 | OA OX App Suite OX Software GmbH | 5.5 | Aug 2 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources |
| CVE-2023-26440 | OA OX App Suite OX Software GmbH | 7.8 | Aug 2 | The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups |
| CVE-2023-26439 | OA OX App Suite OX Software GmbH | 7.8 | Aug 2 | The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement |
| CVE-2023-26438 | OA OX App Suite OX Software GmbH | 3.1 | Aug 2 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache |
| CVE-2023-26430 | OA OX App Suite OX Software GmbH | 4.3 | Aug 2 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules |
| CVE-2023-26436 | OA OX App Suite OX Software GmbH | 8.8 | Jun 20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization |
| CVE-2023-26435 | OA OX App Suite OX Software GmbH | 5.0 | Jun 20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents |
| CVE-2023-26434 | OA OX App Suite OX Software GmbH | 4.3 | Jun 20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes |
| CVE-2023-26433 | OA OX App Suite OX Software GmbH | 4.3 | Jun 20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes |
| CVE-2023-26432 | OA OX App Suite OX Software GmbH | 4.3 | Jun 20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes |
| CVE-2023-26431 | OA OX App Suite OX Software GmbH | 4.3 | Jun 20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made |
| CVE-2023-26429 | OA OX App Suite OX Software GmbH | 5.3 | Jun 20 | Control characters were not removed when exporting user feedback content |
| CVE-2023-26428 | OA OX App Suite OX Software GmbH | 6.5 | Jun 20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context |
| CVE-2023-26427 | OA OX App Suite OX Software GmbH | 3.3 | Jun 20 | Default permissions for a properties file were too permissive |