OX Software vulnerabilities
We track 10 vulnerabilities in OX Software products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2023.
Latest OX Software vulnerabilities
- 7.3 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify
- 7.8 High severity
OX App Suite: Improper Authentication
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interfa
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by defa
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. A
- 8.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to publi
- 7.5 High severity
OX App Suite: Use of Insufficiently Random Values
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization proces
- 9.8 Critical severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerabili
- 7.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary S
- 7.8 High severity
OX App Suite: Improper Neutralization of Special Elements used in an SQL Command
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discoverin
- 8.8 High severity
OX App Suite: Deserialization of Untrusted Data
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected