CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-26456
https://notcve.org/view.php?id=CVE-2023-26456
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known. • https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-28944 – OX App Suite / OX Guard SSRF / DoS / Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-28944
OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. OX Guard vesiones 2.10.4 y anteriores permiten una Denegación de Servicio por medio de un servidor WKS que responde lentamente o con una gran cantidad de datos. OX App Suite versions 7.10.4 and below suffer from cross site scripting and server-side request forgery vulnerabilities. OX Guard versions 2.10.4 and below suffer from a denial of service vulnerability. • http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html https://open-xchange.com • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9426 – OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2020-9426
OX Guard 2.10.3 and earlier allows XSS. OX Guard versiones 2.10.3 y anteriores, permiten un ataque de tipo XSS OX Guard version 2.10.3 suffers from server-side request forgery and cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/158069/OX-Guard-2.10.3-Cross-Site-Scripting-Server-Side-Request-Forgery.html https://seclists.org/fulldisclosure/2020/Jun/20 https://www.open-xchange.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9427 – OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2020-9427
OX Guard 2.10.3 and earlier allows SSRF. OX Guard versiones 2.10.3 y anteriores, permiten un ataque de tipo SSRF OX Guard version 2.10.3 suffers from server-side request forgery and cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/158069/OX-Guard-2.10.3-Cross-Site-Scripting-Server-Side-Request-Forgery.html https://seclists.org/fulldisclosure/2020/Jun/20 https://www.open-xchange.com • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-10986
https://notcve.org/view.php?id=CVE-2018-10986
OX Guard 2.8.0 has CSRF. OX Guard en la versión 2.8.0 tiene Cross-Site Request Forgery (CSRF). • http://software.open-xchange.com/products/guard/doc/OX_Guard_Release_Notes_for_Release_2.10.0_2018-07-04.pdf • CWE-352: Cross-Site Request Forgery (CSRF) •