| Package | Affected versions | Patched versions |
|---|---|---|
| ox guard | = 2.10.7< 2.10.7 | 2.10.7 |
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free