OX App Suite at a glance
- Last 12 months
- 4
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 4 | 0 |
| Oct 2025 | 2 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
27 results · Feed
-
Medium 6.1
Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the u…
-
Medium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Uninten…
-
Medium 5.4
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can…
-
Medium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Uninten…
-
Medium 5.4
Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended ac…
-
High 7.5
Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict infor…
-
Medium 5.4
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers c…
-
Medium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user …
-
Medium 6.5
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the user…
-
Medium 6.5
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "s…
-
Medium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mob…
-
Medium 6.1
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when…
-
Medium 5.4
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser ses…
-
Medium 5.4
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users br…
-
Medium 5.4
Embedded content references at tasks could be used to temporarily execute script code in the context of the users brows…
-
Medium 5.4
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app…
-
Medium 6.5
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to…
-
Medium 6.5
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource thr…
-
Medium 6.5
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to …
-
High 7.1
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engin…
-
Medium 6.1
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a us…
-
Medium 5.4
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when addi…
-
Medium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not saniti…
-
High 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing …
-
High 7.6
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to a…
-
Medium 5.4
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure u…
-
High 8.8
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as t…