CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view. |
| 30/04/2021 |
| CVE-2021-31934 | MEDIUM6.1 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone. | 30/04/2021 |
| CVE-2020-28944 | HIGH7.5 | OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. | 30/04/2021 |
| CVE-2020-28943 | MEDIUM6.5 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet. | 30/04/2021 |
| CVE-2021-23936 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via the subject of a task. | 12/01/2021 |
| CVE-2021-23935 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. | 12/01/2021 |
| CVE-2021-23934 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. | 12/01/2021 |
| CVE-2021-23933 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. | 12/01/2021 |
| CVE-2021-23932 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. | 12/01/2021 |
| CVE-2021-23931 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via an inline binary file. | 12/01/2021 |
| CVE-2021-23930 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. | 12/01/2021 |
| CVE-2021-23929 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI. | 12/01/2021 |
| CVE-2021-23928 | MEDIUM6.1 | OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. | 12/01/2021 |
| CVE-2021-23927 | MEDIUM6.4 | OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. | 12/01/2021 |
| CVE-2020-24701 | MEDIUM6.1 | OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). | 12/01/2021 |
| CVE-2020-24700 | MEDIUM5.4 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. | 12/01/2021 |
| CVE-2020-15004 | MEDIUM4.8 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. | 23/10/2020 |