CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/11/2021 |
| CVE-2021-38376 | MEDIUM5.3 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | 22/11/2021 |
| CVE-2021-38375 | MEDIUM6.1 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. | 22/11/2021 |
| CVE-2021-38374 | MEDIUM5.4 | OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. | 22/11/2021 |
| CVE-2021-33495 | MEDIUM6.1 | OX App Suite 7.10.5 allows XSS via an OX Chat system message. | 22/11/2021 |
| CVE-2021-33494 | MEDIUM6.1 | OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. | 22/11/2021 |
| CVE-2021-33493 | MEDIUM6.0 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. | 22/11/2021 |
| CVE-2021-33492 | MEDIUM6.1 | OX App Suite 7.10.5 allows XSS via an OX Chat room name. | 22/11/2021 |
| CVE-2021-33491 | MEDIUM6.5 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records. | 22/11/2021 |
| CVE-2021-33490 | MEDIUM6.1 | OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. | 22/11/2021 |
| CVE-2021-33489 | MEDIUM6.1 | OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. | 22/11/2021 |
| CVE-2021-33488 | MEDIUM6.1 | chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. | 22/11/2021 |
| CVE-2021-28095 | MEDIUM4.8 | OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32. | 30/07/2021 |
| CVE-2021-28094 | MEDIUM6.5 | OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. | 30/07/2021 |
| CVE-2021-28093 | MEDIUM6.5 | OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. | 30/07/2021 |
| CVE-2021-37403 | MEDIUM6.1 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used. | 22/07/2021 |
| CVE-2021-37402 | MEDIUM6.1 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled. | 22/07/2021 |