Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2855▼ 333 respecto a la semana anterior
Críticas / altas1381▼ 36 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)296▼ 213 respecto a la semana anterior
50 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.5) | 0.96% | — | Open-xchange OX APP Suite | 27/7/2022 | 17/6/2026 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | |
| Modificada | Crítica (9.8) | 3.1% | — | Open-xchange OX APP Suite | 27/7/2022 | 17/6/2026 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. | |
| Modificada | Media (6.1) | 0.69% | — | Open-xchange OX APP Suite | 27/7/2022 | 17/6/2026 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. | |
| Modificada | Crítica (9.8) | 2.9% | — | Open-xchange OX APP Suite | 27/7/2022 | 17/6/2026 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). | |
| Modificada | Media (5.4) | 0.66% | — | Open-xchange APP Suite | 27/7/2022 | 17/6/2026 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. | |
| Modificada | Media (6.1) | 0.93% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | |
| Modificada | Media (6.1) | 0.93% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | |
| Modificada | Media (5.4) | 0.66% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. | |
| Modificada | Media (6.1) | 0.91% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | |
| Modificada | Media (6.1) | 0.90% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. | |
| Modificada | Media (6.1) | 0.90% | — | Open-xchange OX APP Suite | 28/3/2022 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat. | |
| Modificada | Media (4.3) | 1.3% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. | |
| Modificada | Media (6.1) | 1.2% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. | |
| Modificada | Media (5.3) | 1.5% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | |
| Modificada | Media (6.1) | 1.4% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. | |
| Modificada | Media (5.4) | 1.3% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. | |
| Modificada | Media (6.1) | 1.1% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite 7.10.5 allows XSS via an OX Chat system message. | |
| Modificada | Media (6.1) | 1.1% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. | |
| Modificada | Media (6) | 0.49% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. | |
| Modificada | Media (6.1) | 1.1% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite 7.10.5 allows XSS via an OX Chat room name. | |
| Modificada | Media (6.5) | 2.5% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records. | |
| Modificada | Media (6.1) | 1.3% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. | |
| Modificada | Media (6.1) | 1.3% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. | |
| Modificada | Media (6.1) | 1.2% | — | Open-xchange OX APP Suite | 22/11/2021 | 17/6/2026 | chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. | |
| Modificada | Media (4.3) | 2.4% | — | Open-xchange APP Suite | 1/12/2014 | 17/6/2026 | Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not… |