OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.
OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.