CVSS: 5.4EPSS: 0%CPEs: 45EXPL: 0CVE-2022-29853
https://notcve.org/view.php?id=CVE-2022-29853
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. OX App Suite hasta 8.2 permite XSS a través de una cierta jerarquía compleja que obliga al uso de Mostrar Mensaje Completo para un mensaje de correo electrónico HTML enorme. • https://open-xchange.com https://seclists.org/fulldisclosure/2022/Sep/0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 45EXPL: 0CVE-2022-29852
https://notcve.org/view.php?id=CVE-2022-29852
OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. OX App Suite hasta 8.2 permite XSS porque BMFreehand10 e image/x-freehand no están bloqueados. • https://open-xchange.com https://seclists.org/fulldisclosure/2022/Sep/0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29851
https://notcve.org/view.php?id=CVE-2022-29851
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document. documentconverter en OX App Suite versiones hasta 7.10.6, en una configuración no predeterminada con ghostscript, permite una inyección de comandos del sistema operativo porque la conversión de archivos puede ocurrir para un documento EPS que se disfraza como un documento PDF • https://packetstormsecurity.com/files/168242/OX-App-Suite-Cross-Site-Scripting-Command-Injection.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-24406
https://notcve.org/view.php?id=CVE-2022-24406
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. OX App Suite versiones hasta 7.10.6, permite un ataque de tipo SSRF porque los límites de multipart/form-data son predecibles, y esto puede conllevar a una inyección en las llamadas internas de la API de Documentconverter • https://open-xchange.com https://seclists.org/fulldisclosure/2022/Jul/11 • CWE-330: Use of Insufficiently Random Values •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23099
https://notcve.org/view.php?id=CVE-2022-23099
OX App Suite through 7.10.6 allows XSS by forcing block-wise read. OX App Suite versiones hasta 7.10.6, permite un ataque de tipo XSS al forzar una lectura en bloque • https://open-xchange.com https://seclists.org/fulldisclosure/2022/Jul/11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •