Alinto
Alinto Sogo: vulnerabilidades y CVE
Alinto Sogo tiene 17 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses6
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-8496 | Media (6.1) | 0.51% | — | 13 may 2026 | A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session.… |
| CVE-2026-33550 | Baja (2.6) | 0.21% | — | 22 mar 2026 | SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). |
| CVE-2025-71276 | Media (6.1) | 0.14% | — | 22 mar 2026 | SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. |
| CVE-2026-3054 | Baja (2.1) | 0.47% | — | 24 feb 2026 | A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is… |
| CVE-2025-63499 | Media (6.1) | 0.30% | — | 4 dic 2025 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. |
| CVE-2025-63498 | Media (6.1) | 0.29% | — | 24 nov 2025 | alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. |
| CVE-2025-53603 | Alta (7.5) | 0.69% | — | 5 jul 2025 | In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the… |
| CVE-2024-24510 | Media (6.1) | 0.48% | — | 9 sept 2024 | Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component. |
| CVE-2024-34462 | Media (6.1) | 0.35% | — | 4 may 2024 | Alinto SOGo through 5.10.0 allows XSS during attachment preview. |
| CVE-2023-48104 | Media (6.1) | 1.0% | — | 16 ene 2024 | Alinto SOGo before 5.9.1 is vulnerable to HTML Injection. |
| CVE-2022-4558 | Media (6.1) | 0.59% | — | 16 dic 2022 | A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The… |
| CVE-2022-4556 | Media (6.1) | 0.59% | — | 16 dic 2022 | A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity… |
| CVE-2015-5395 | Alta (8.8) | 0.89% | — | 20 sept 2017 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. |
| CVE-2016-6191 | Media (6.1) | 1.2% | — | 17 feb 2017 | Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2)… |
| CVE-2016-6189 | Media (4.3) | 1.4% | — | 17 feb 2017 | Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds. |
| CVE-2014-9905 | Media (6.1) | 1.2% | — | 17 feb 2017 | Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields. |
| CVE-2016-6188 | Media (6.5) | 2.2% | — | 3 feb 2017 | Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.