CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 12/01/2021 |
| CVE-2020-24700 | 中危5.4 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. | 12/01/2021 |
| CVE-2020-15004 | 中危4.8 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. | 23/10/2020 |
| CVE-2020-15003 | 中危4.3 | OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access). | 23/10/2020 |
| CVE-2020-15002 | 中危5.0 | OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API. | 23/10/2020 |
| CVE-2020-12646 | 中危5.4 | OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. | 31/08/2020 |
| CVE-2020-12645 | 严重9.8 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption. | 31/08/2020 |
| CVE-2020-12644 | 中危5.0 | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API. | 31/08/2020 |
| CVE-2020-12643 | 中危4.3 | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. | 31/08/2020 |
| CVE-2020-8544 | 中危6.5 | OX App Suite through 7.10.3 allows SSRF. | 16/06/2020 |
| CVE-2020-8543 | 高危7.5 | OX App Suite through 7.10.3 has Improper Input Validation. | 16/06/2020 |
| CVE-2020-8542 | 中危5.4 | OX App Suite through 7.10.3 allows XSS. | 16/06/2020 |
| CVE-2020-8541 | 中危6.5 | OX App Suite through 7.10.3 allows XXE attacks. | 16/06/2020 |
| CVE-2019-18846 | 中危5.0 | OX App Suite through 7.10.2 allows SSRF. | 21/02/2020 |
| CVE-2014-5236 | 高危7.5 | Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file. | 31/01/2020 |
| CVE-2014-5238 | 高危7.8 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document. | 14/01/2020 |
| CVE-2019-16717 | 中危6.1 | OX App Suite through 7.10.2 has XSS. | 06/01/2020 |