CVE-2021-38374

Description

References

• packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html · Exploit
• packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html · Exploit
• seclists.org/fulldisclosure/2021/Nov/43 · Exploit
• seclists.org/fulldisclosure/2022/Jul/11 · Mailing List
• open-xchange.com · Product

More vulnerabilities in ox app suite

• CVE-2024-23193MEDIUM 5.3E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the…
• CVE-2024-23187MEDIUM 6.1Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Att…
• CVE-2024-23186MEDIUM 6.1E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attacker…
• CVE-2023-41710MEDIUM 5.4User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attacke…
• CVE-2023-29052MEDIUM 5.4Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attack…