CVE-2019-16717

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OX App Suite through 7.10.2 has XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155813/OX-App-Suite-7.10.2-Cross-Site-Scripting-Improper-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.com/Product
http://packetstormsecurity.com/files/155813/OX-App-Suite-7.10.2-Cross-Site-Scripting-Improper-Access-Control.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/7Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.com/Product

Timeline

Published: Jan 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167187.8In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, CVE-2019-167196.5WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.CVE-2019-16725.8A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticat CVE-2019-167207.5ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demons CVE-2019-167216.5NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.CVE-2019-167229.8ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operatio CVE-2019-167234.3In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a CVE-2019-167249.8File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) bas CVE-2019-167256.1In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.CVE-2019-167286.1DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome a CVE-2019-167297.8pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root es CVE-2019-16735.4A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker