Vendor
OX Software
33 known vulnerabilities.
OX Software at a glance
- Last 12 months
- 0
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
33 results · Feed
-
Medium 5.3
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowi…
-
Medium 4.3
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, in…
-
Medium 5.4
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.…
-
Medium 5.4
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be inj…
-
Medium 6.1
Presentations may contain references to images, which are user-controlled, and could include malicious script code that…
-
Medium 5.4
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before…
-
Medium 5.6
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent…
-
High 7.6
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting th…
-
High 7.6
Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vul…
-
High 7.6
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchec…
-
High 7.5
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization…
-
Medium 5.4
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious scri…
-
Medium 5.4
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious scrip…
-
Medium 5.4
Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handle…
-
Medium 5.4
The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controll…
-
Medium 5.4
The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script …
-
Medium 5.4
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets proc…
-
Medium 5.5
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitizat…
-
Low 3.2
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by t…
-
Medium 5.7
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when acces…
-
High 7.1
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized…
-
High 7.6
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before get…
-
Medium 4.3
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, in…
-
Low 3.5
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could b…
-
High 7.1
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not prope…
-
Medium 5.0
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT do…
-
Medium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 5.0
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wi…
-
Low 3.5
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected …
-
Medium 6.5
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same co…
-
Low 3.2
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive info…