CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 보통5.3 |
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
| 26/12/2022 |
| CVE-2022-37312 | 보통5.3 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. | 26/12/2022 |
| CVE-2022-37311 | 보통5.3 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. | 26/12/2022 |
| CVE-2022-37307 | 보통6.1 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. | 26/12/2022 |
| CVE-2022-31469 | 보통6.1 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. | 26/12/2022 |
| CVE-2022-31468 | 보통6.1 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. | 25/10/2022 |
| CVE-2022-29851 | 심각9.8 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document. | 25/10/2022 |
| CVE-2022-24406 | 보통6.5 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | 27/07/2022 |
| CVE-2022-24405 | 심각9.8 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. | 27/07/2022 |
| CVE-2022-23101 | 보통6.1 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. | 27/07/2022 |
| CVE-2022-23100 | 심각9.8 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). | 27/07/2022 |
| CVE-2022-23099 | 보통5.4 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. | 27/07/2022 |
| CVE-2021-44213 | 보통6.1 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | 28/03/2022 |
| CVE-2021-44212 | 보통6.1 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | 28/03/2022 |
| CVE-2021-44211 | 보통5.4 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. | 28/03/2022 |
| CVE-2021-44210 | 보통6.1 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | 28/03/2022 |