Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

200 results · page 2 of 4

Aug 2, 2023Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules.CVE-2023-26430 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.5
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization.CVE-2023-26436 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.1
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents.CVE-2023-26435 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes.CVE-2023-26434 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes.CVE-2023-26433 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes.CVE-2023-26432 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made.CVE-2023-26431 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functionality and trigger requests to restricted network infrastructure to gain insight about topology and running services. We now respect possible IPV4-mapped IPv6 addresses when checking if contained in a deny-list. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023Control characters were not removed when exporting user feedback content.CVE-2023-26429 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.5
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We now drop all control characters that are not whitespace character during the export. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context.CVE-2023-26428 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 6.5
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 20, 2023Default permissions for a properties file were too permissive.CVE-2023-26427 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.2
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.CVE-2023-24605 · Other software · Open-xchange · reported by MITREMedium 4.2
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimCVE-2023-24604 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amoCVE-2023-24603 · Other software · Open-xchange · reported by MITREMedium 6.5
OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.CVE-2023-24602 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.CVE-2023-24601 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.CVE-2023-24600 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion.CVE-2023-24599 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of anotCVE-2023-24598 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
May 28, 2023OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.CVE-2023-24597 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org open-xchange.com
Apr 15, 2023OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.CVE-2022-37306 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls theCVE-2022-43699 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.CVE-2022-43698 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-43697 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Apr 14, 2023OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-43696 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.CVE-2022-37310 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.CVE-2022-37309 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.CVE-2022-29853 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-29852 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.CVE-2022-37308 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.CVE-2022-37313 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.CVE-2022-37312 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.CVE-2022-37311 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.CVE-2022-37307 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Dec 25, 2022OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.CVE-2022-31469 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
Product
Open-xchange Appsuite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Oct 25, 2022OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.CVE-2022-31468 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 25, 2022documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occurCVE-2022-29851 · Other software · Open-xchange · reported by MITRECritical 9.8
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 27, 2022OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter ACVE-2022-24406 · Other software · Open-xchange · reported by MITREMedium 6.5
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Jul 27, 2022OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.CVE-2022-24405 · Other software · Open-xchange · reported by MITRECritical 9.8
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Jul 27, 2022OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.CVE-2022-23101 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Jul 27, 2022OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).CVE-2022-23100 · Other software · Open-xchange · reported by MITRECritical 9.8
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Jul 27, 2022OX App Suite through 7.10.6 allows XSS by forcing block-wise read.CVE-2022-23099 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
Product
App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com seclists.org
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.CVE-2021-44213 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-xchange.com packetstormsecurity.com
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.CVE-2021-44212 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.CVE-2021-44211 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.CVE-2021-44210 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.CVE-2021-44209 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.CVE-2021-44208 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Nov 22, 2021OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.CVE-2021-38378 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 22, 2021OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tranCVE-2021-38377 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 22, 2021OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.CVE-2021-38376 · Other software · Open-xchange · reported by MITREMedium 5.3
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.