CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view. |
| 30/04/2021 |
| CVE-2021-31934 | 中危6.1 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone. | 30/04/2021 |
| CVE-2020-28944 | 高危7.5 | OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. | 30/04/2021 |
| CVE-2020-28943 | 中危6.5 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet. | 30/04/2021 |
| CVE-2021-23936 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via the subject of a task. | 12/01/2021 |
| CVE-2021-23935 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. | 12/01/2021 |
| CVE-2021-23934 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. | 12/01/2021 |
| CVE-2021-23933 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. | 12/01/2021 |
| CVE-2021-23932 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. | 12/01/2021 |
| CVE-2021-23931 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via an inline binary file. | 12/01/2021 |
| CVE-2021-23930 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. | 12/01/2021 |
| CVE-2021-23929 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI. | 12/01/2021 |
| CVE-2021-23928 | 中危6.1 | OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. | 12/01/2021 |
| CVE-2021-23927 | 中危6.4 | OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. | 12/01/2021 |
| CVE-2020-24701 | 中危6.1 | OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). | 12/01/2021 |
| CVE-2020-24700 | 中危5.4 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. | 12/01/2021 |
| CVE-2020-15004 | 中危4.8 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. | 23/10/2020 |