CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2022-37313 |
| MEDIO5.3 |
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
| 26/12/2022 |
| CVE-2022-37312 | MEDIO5.3 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. | 26/12/2022 |
| CVE-2022-37311 | MEDIO5.3 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. | 26/12/2022 |
| CVE-2022-37307 | MEDIO6.1 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. | 26/12/2022 |
| CVE-2022-31469 | MEDIO6.1 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. | 26/12/2022 |
| CVE-2022-31468 | MEDIO6.1 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. | 25/10/2022 |
| CVE-2022-29851 | CRITICO9.8 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document. | 25/10/2022 |
| CVE-2022-24406 | MEDIO6.5 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | 27/07/2022 |
| CVE-2022-24405 | CRITICO9.8 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. | 27/07/2022 |
| CVE-2022-23101 | MEDIO6.1 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. | 27/07/2022 |
| CVE-2022-23100 | CRITICO9.8 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). | 27/07/2022 |
| CVE-2022-23099 | MEDIO5.4 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. | 27/07/2022 |
| CVE-2021-44213 | MEDIO6.1 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | 28/03/2022 |
| CVE-2021-44212 | MEDIO6.1 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | 28/03/2022 |
| CVE-2021-44211 | MEDIO5.4 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. | 28/03/2022 |
| CVE-2021-44210 | MEDIO6.1 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | 28/03/2022 |