Skip to contentOpen-xchange Gmbh vulnerabilities
Newest
- open-xchange ox dovecot proVery large headers can cause resource exhaustion when parsing message. The message-parser...CVE-2024-23185Fix available7.5 High
- open-xchange gmbh ox dovecot proHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU...CVE-2024-23184Fix available5.0 Medium
- open-xchange ox app suiteE-Mails exported as PDF were stored in a cache that did not consider specific session information...CVE-2024-231935.3 Medium
- open-xchange app suite, open-xchange gmbh ox app suite +1 moreMaliciously crafted E-Mail attachment names could be used to temporarily execute script code in...CVE-2024-231886.5 Medium
- open-xchange ox app suiteContent-ID based embedding of resources in E-Mails could be abused to trigger client-side script...CVE-2024-231876.5 Medium
- open-xchange ox app suiteE-Mail containing malicious display-name information could trigger client-side script execution...CVE-2024-231866.5 Medium
- open-xchange gmbh ox app suiteRSS feeds that contain malicious data- attributes could be abused to inject script code to a...CVE-2024-231926.1 Medium
- open-xchange gmbh ox app suiteUpsell advertisement information of an account can be manipulated to execute script code in the...CVE-2024-231915.4 Medium
- open-xchange gmbh ox app suiteUpsell shop information of an account can be manipulated to execute script code in the context of...CVE-2024-231905.4 Medium
- open-xchange gmbh ox app suiteEmbedded content references at tasks could be used to temporarily execute script code in the...CVE-2024-231895.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreReferences to the "app loader" functionality could contain redirects to unexpected locations....CVE-2023-417085.4 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing of user-defined mail search expressions is not limited. Availability of OX App Suite...CVE-2023-417076.5 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing time of drive search expressions now gets monitored, and the related request is...CVE-2023-417066.5 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite...CVE-2023-417056.5 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreProcessing of CID references at E-Mail can be abused to inject malicious script code that passes...CVE-2023-417047.1 High
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreUser ID references at mentions in document comments were not correctly sanitized. Script code...CVE-2023-417036.1 Medium
- open-xchange ox app suiteUser-defined script code could be stored for a upsell related shop URL. This code was not...CVE-2023-417105.4 Medium
- open-xchange ox app suiteUsers were able to define disclaimer texts for an upsell shop dialog that would contain script...CVE-2023-290525.4 Medium
- open-xchange ox app suiteUser-defined OXMF templates could be used to access a limited part of the internal OX App Suite...CVE-2023-290518.1 High
- open-xchange ox app suiteThe optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter...CVE-2023-290507.6 High
- open-xchange ox app suiteThe "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers...CVE-2023-290495.4 Medium
- open-xchange ox app suiteA component for parsing OXMF templates could be abused to execute arbitrary system commands that...CVE-2023-290488.8 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreImageconverter API endpoints provided methods that were not sufficiently validating and...CVE-2023-290475.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreConnections to external data sources, like e-mail autoconfiguration, were not terminated in case...CVE-2023-290464.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations, in this case "drawing", could be manipulated to contain invalid data types,...CVE-2023-290455.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations could be manipulated to contain invalid data types, possibly script code....CVE-2023-290445.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 morePresentations may contain references to images, which are user-controlled, and could include...CVE-2023-290436.1 Medium
- open-xchange ox guard, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreUsers were able to set an arbitrary "product name" for OX Guard. The chosen value was not...CVE-2023-264565.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers...CVE-2023-264555.6 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to fetch image metadata could be abused to include SQL queries that would be executed...CVE-2023-264547.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image could be abused to include SQL queries that would be executed...CVE-2023-264537.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image and return its metadata could be abused to include SQL queries that...CVE-2023-264527.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFunctions with insufficient randomness were used to generate authorization tokens of the...CVE-2023-264517.5 High
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Count" web service did not specify a media-type when processing responses by external...CVE-2023-264505.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Chat" web service did not specify a media-type when processing responses by external...CVE-2023-264495.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCustom log-in and log-out locations are used-defined as jslob but were not checked to contain...CVE-2023-264485.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "upsell" widget for the portal allows to specify a product description. This description...CVE-2023-264475.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe users clientID at "application passwords" was not sanitized or escaped before being added to...CVE-2023-264465.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFrontend themes are defined by user-controllable jslob settings and could point to a malicious...CVE-2023-264455.4 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements....CVE-2023-264435.5 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIn case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP...CVE-2023-264423.2 Low
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCacheservice did not correctly check if relative cache object were pointing to the defined...CVE-2023-264415.7 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to indirectly inject parameters with SQL syntax which was...CVE-2023-264407.1 High
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to inject parameters with SQL syntax which was...CVE-2023-264397.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreExternal service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use...CVE-2023-264384.3 Medium
- ox software gmbh app suite, open-xchange appsuite backend, open-xchange gmbh ox app suite +2 moreAttackers with access to user accounts can inject arbitrary control characters to SIEVE mail...CVE-2023-264303.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...CVE-2023-264367.1 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIt was possible to call filesystem and network references using the local LibreOffice instance...CVE-2023-264355.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited...CVE-2023-264344.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited...CVE-2023-264334.3 Medium
- Show moreLoading…