Vendor
OX Software
33 known vulnerabilities.
Products
22 results · Clear filters · Feed
-
Medium 5.3
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowi…
-
Medium 4.3
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, in…
-
Medium 5.4
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.…
-
Medium 5.4
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be inj…
-
Medium 6.1
Presentations may contain references to images, which are user-controlled, and could include malicious script code that…
-
Medium 5.4
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before…
-
Medium 5.6
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent…
-
Medium 5.4
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious scri…
-
Medium 5.4
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious scrip…
-
Medium 5.4
Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handle…
-
Medium 5.4
The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controll…
-
Medium 5.4
The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script …
-
Medium 5.4
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets proc…
-
Medium 5.5
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitizat…
-
Medium 5.7
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when acces…
-
Medium 4.3
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, in…
-
Medium 5.0
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT do…
-
Medium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. A…
-
Medium 5.0
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wi…
-
Medium 6.5
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same co…