Updated 34 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

285 results · page 2 of 6

Sep 6, 2024Dovecot accepts dot LF DOT LF symbol as end of DATA command.CVE-2024-25584 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.3
Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known.
Product
OX Dovecot Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Aug 19, 2024Module savepoints could be abused to inject references to malicious code delivered through the same domain.CVE-2024-25582 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
May 6, 2024E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.CVE-2024-23193 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session.CVE-2024-23188 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.CVE-2024-23187 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.CVE-2024-23186 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
Apr 8, 2024RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successCVE-2024-23192 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session.CVE-2024-23191 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session.CVE-2024-23190 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session.CVE-2024-23189 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering attack to make users import external content. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-generated content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Feb 12, 2024References to the "app loader" functionality could contain redirects to unexpected locations.CVE-2023-41708 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of user-defined mail search expressions is not limited.CVE-2023-41707 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.CVE-2023-41706 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of user-defined DAV user-agent strings is not limited.CVE-2023-41705 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.CVE-2023-41704 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.1
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024User ID references at mentions in document comments were not correctly sanitized.CVE-2023-41703 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024User-defined script code could be stored for a upsell related shop URL.CVE-2023-41710 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly.CVE-2023-29052 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API.CVE-2023-29051 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hieCVE-2023-29050 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.6
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 8, 2024The "upsell" widget at the portal page could be abused to inject arbitrary script code.CVE-2023-29049 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 8, 2024A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.CVE-2023-29048 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 8.8
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.CVE-2023-24605 · Other software · Open-xchange · reported by MITREMedium 4.2
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimCVE-2023-24604 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amoCVE-2023-24603 · Other software · Open-xchange · reported by MITREMedium 6.5
OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.CVE-2023-24602 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.CVE-2023-24601 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.CVE-2023-24600 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion.CVE-2023-24599 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of anotCVE-2023-24598 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.CVE-2023-24597 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
Apr 15, 2023OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.CVE-2022-37306 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls theCVE-2022-43699 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.CVE-2022-43698 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-43697 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-43696 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.CVE-2022-37310 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.CVE-2022-37309 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.CVE-2022-29853 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-29852 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.CVE-2022-37308 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.CVE-2022-37313 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.CVE-2022-37312 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.CVE-2022-37311 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.CVE-2022-37307 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.CVE-2022-31469 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Oct 25, 2022OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.CVE-2022-31468 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 25, 2022documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occurCVE-2022-29851 · Other software · Open-xchange · reported by MITRECritical 9.8
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 27, 2022OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter ACVE-2022-24406 · Other software · Open-xchange · reported by MITREMedium 6.5
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Jul 27, 2022OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.CVE-2022-24405 · Other software · Open-xchange · reported by MITRECritical 9.8
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.