CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). |
| 22/05/2019 |
| CVE-2017-5863 | 严重9.8 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | 22/05/2019 |
| CVE-2017-9809 | 中危5.3 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. | 22/05/2019 |
| CVE-2017-12884 | 高危7.5 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. | 10/05/2019 |
| CVE-2017-12885 | 中危6.1 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | 10/05/2019 |
| CVE-2018-13104 | 中危5.4 | OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID) | 21/03/2019 |
| CVE-2018-13103 | 中危5.4 | OX App Suite 7.8.4 and earlier allows SSRF. | 21/03/2019 |
| CVE-2018-12611 | 中危6.1 | OX App Suite 7.8.4 and earlier allows Directory Traversal. | 30/01/2019 |
| CVE-2018-12610 | 中危5.3 | OX App Suite 7.8.4 and earlier allows Information Exposure. | 30/01/2019 |
| CVE-2018-12609 | 中危6.5 | OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. | 30/01/2019 |
| CVE-2017-6913 | 中危6.1 | Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag. | 18/09/2018 |
| CVE-2018-9998 | 中危6.5 | Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks. | 05/07/2018 |
| CVE-2018-9997 | 中危6.1 | Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets | 05/07/2018 |
| CVE-2018-5756 | 中危4.3 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/ta | 16/06/2018 |
| CVE-2018-5755 | 中危5.5 | Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet. | 16/06/2018 |
| CVE-2018-5754 | 中危5.4 | Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard. | 16/06/2018 |