Advisories · Technology
Intermesh groupoffice.
Every CVE that names Intermesh groupoffice among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.0 Medium
Group-Office: SSRF via Bookmark/description JMAP action — server makes arbitrary HTTP(S) requests to user-controlled URL and reflects part of the response
- Intermesh groupoffice
- Server-side request forgery (SSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+
GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels
- Intermesh groupoffice
- Code injection
- CWE-184
- CVSS 8.7 High
Group-Office: Stored XSS via Manual Reminders
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write
- Intermesh groupoffice
- Cross-site scripting (XSS)
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
- Intermesh groupoffice
- Insecure deserialization
- CVSS 8.8 High
Authenticated SQL Injection in Contact/query addressBookIds filter
- Intermesh groupoffice
- SQL injection
- CVSS 5.1 Medium
Group-Office: Reflected XSS in JavaScript context
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Group-Office Vulnerable to Remote Code Execution (RCE)
- Intermesh groupoffice
- Command injection
- Unrestricted file upload
- CVSS 7.1 High
Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
- Intermesh groupoffice
- SQL injection
- CVSS 8.2 High
Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
- Intermesh groupoffice
- Server-side request forgery (SSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
- Intermesh groupoffice
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Group-Office Argument Injection in MaintenanceController::actionZipLanguage
- Intermesh groupoffice
- Command injection
- CVSS 5.1 Medium
Group-Office has stored XSS vulnerability via unsanitized filenames
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CWE-20
- CVSS 5.3 Medium
Group-Office vulnerable to reflected XSS via Look and Feel Formatting input
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
Group-Office vulnerable to blind XSS
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
GroupOffice vulnerable to Stored XSS in Tasks Comment Section
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Group-Office has a Stored XSS Vulnerability via user's name field
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice
- Intermesh groupoffice
- Cross-site scripting (XSS)
- CVSS 7.4 High
Server-Side Request Forgery in groupoffice
- Intermesh groupoffice
- Server-side request forgery (SSRF)