CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2021-33491 – OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal
https://notcve.org/view.php?id=CVE-2021-33491
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records. OX App Suite versiones hasta 7.10.5, permite un salto de directorios por medio de ../ en un archivo ZIP OOXML u ODF, debido al manejo inapropiado de las rutas relativas en las direcciones de correo en conjunto con los registros DNS de auto-configuración OX App Suite and OX Documents suffer from cross site scripting, code injection, path traversal, and input validation vulnerabilities. Most of these issues affect 7.10.5 and below with one affecting 7.10.4 and below. • http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html https://open-xchange.com https://seclists.org/fulldisclosure/2021/Nov/42 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-33490 – OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal
https://notcve.org/view.php?id=CVE-2021-33490
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. OX App Suite versiones hasta 7.10.5, permite un ataque de tipo XSS por medio de un fragmento diseñado en una firma de correo compartida OX App Suite and OX Documents suffer from cross site scripting, code injection, path traversal, and input validation vulnerabilities. Most of these issues affect 7.10.5 and below with one affecting 7.10.4 and below. • http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html https://open-xchange.com https://seclists.org/fulldisclosure/2021/Nov/42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-33489 – OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal
https://notcve.org/view.php?id=CVE-2021-33489
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. OX App Suite versiones hasta 7.10.5, permite un ataque de tipo XSS por medio de código JavaScript en un archivo XCF compartido OX App Suite and OX Documents suffer from cross site scripting, code injection, path traversal, and input validation vulnerabilities. Most of these issues affect 7.10.5 and below with one affecting 7.10.4 and below. • http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html http://seclists.org/fulldisclosure/2021/Nov/42 https://open-xchange.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-33488 – OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal
https://notcve.org/view.php?id=CVE-2021-33488
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. El chat en OX App Suite versión 7.10.5, presenta una comprobación de entrada inapropiada. Un usuario puede ser redirigido a un servidor de OX Chat fraudulento por medio de un hook relacionado con el desarrollo OX App Suite and OX Documents suffer from cross site scripting, code injection, path traversal, and input validation vulnerabilities. Most of these issues affect 7.10.5 and below with one affecting 7.10.4 and below. • http://packetstormsecurity.com/files/165028/OX-App-Suite-Ox-Documents-7.10.x-XSS-Code-Injection-Traversal.html http://seclists.org/fulldisclosure/2021/Nov/42 https://open-xchange.com • CWE-20: Improper Input Validation •