CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/12/2022 |
| CVE-2022-31469 | 中危6.1 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. | 26/12/2022 |
| CVE-2021-37403 | 中危6.1 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used. | 22/07/2021 |
| CVE-2021-37402 | 中危6.1 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled. | 22/07/2021 |
| CVE-2021-26699 | 中危5.4 | OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used. | 22/07/2021 |
| CVE-2021-26698 | 中危6.1 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used. | 22/07/2021 |
| CVE-2020-28945 | 中危6.1 | OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  that is mishandled in the scheduling view. | 30/04/2021 |
| CVE-2021-31934 | 中危6.1 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone. | 30/04/2021 |
| CVE-2020-28943 | 中危6.5 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet. | 30/04/2021 |
| CVE-2021-23936 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via the subject of a task. | 12/01/2021 |
| CVE-2021-23935 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. | 12/01/2021 |
| CVE-2021-23934 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. | 12/01/2021 |
| CVE-2021-23933 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. | 12/01/2021 |
| CVE-2021-23932 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. | 12/01/2021 |
| CVE-2021-23931 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an inline binary file. | 12/01/2021 |
| CVE-2021-23930 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. | 12/01/2021 |