OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constructor, in a Notes item.

OX App Suite 7.10.4 and earlier allows SSRF via a snippet.

OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.

OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access).

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.

OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption.

OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.

OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.

OX App Suite 7.10.1 and earlier allows Information Exposure.

OX App Suite 7.10.0 and earlier has Incorrect Access Control.

OX App Suite through 7.10.2 allows SSRF.

OX App Suite through 7.10.2 has XSS.

OX App Suite through 7.10.2 has Incorrect Access Control.

OX App Suite 7.10.1 and 7.10.2 allows XSS.

OX App Suite through 7.10.2 has Insecure Permissions.

OX App Suite 7.10.1 and 7.10.2 allows SSRF.

OX App Suite 7.10.1 and earlier has Insecure Permissions.