Skip to contentOpen-xchange Appsuite vulnerabilities
- mozilla firefox, firefox esr, thunderbird +5 more +7 morePDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFCVE-2024-4367Public exploitFix availableEPSS 70.7%8.8 High
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreReferences to the "app loader" functionality could contain redirects to unexpected locations....CVE-2023-417085.4 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing of user-defined mail search expressions is not limited. Availability of OX App Suite...CVE-2023-417076.5 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing time of drive search expressions now gets monitored, and the related request is...CVE-2023-417066.5 Medium
- open-xchange gmbh ox app suite, open-xchange appsuite +1 moreProcessing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite...CVE-2023-417056.5 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreProcessing of CID references at E-Mail can be abused to inject malicious script code that passes...CVE-2023-417047.1 High
- open-xchange appsuite, open-xchange gmbh ox app suite +1 moreUser ID references at mentions in document comments were not correctly sanitized. Script code...CVE-2023-417036.1 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreImageconverter API endpoints provided methods that were not sufficiently validating and...CVE-2023-290475.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreConnections to external data sources, like e-mail autoconfiguration, were not terminated in case...CVE-2023-290464.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations, in this case "drawing", could be manipulated to contain invalid data types,...CVE-2023-290455.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations could be manipulated to contain invalid data types, possibly script code....CVE-2023-290445.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 morePresentations may contain references to images, which are user-controlled, and could include...CVE-2023-290436.1 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers...CVE-2023-264555.6 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to fetch image metadata could be abused to include SQL queries that would be executed...CVE-2023-264547.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image could be abused to include SQL queries that would be executed...CVE-2023-264537.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image and return its metadata could be abused to include SQL queries that...CVE-2023-264527.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFunctions with insufficient randomness were used to generate authorization tokens of the...CVE-2023-264517.5 High
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Count" web service did not specify a media-type when processing responses by external...CVE-2023-264505.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Chat" web service did not specify a media-type when processing responses by external...CVE-2023-264495.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCustom log-in and log-out locations are used-defined as jslob but were not checked to contain...CVE-2023-264485.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "upsell" widget for the portal allows to specify a product description. This description...CVE-2023-264475.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe users clientID at "application passwords" was not sanitized or escaped before being added to...CVE-2023-264465.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFrontend themes are defined by user-controllable jslob settings and could point to a malicious...CVE-2023-264455.4 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements....CVE-2023-264435.5 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIn case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP...CVE-2023-264423.2 Low
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCacheservice did not correctly check if relative cache object were pointing to the defined...CVE-2023-264415.7 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to indirectly inject parameters with SQL syntax which was...CVE-2023-264407.1 High
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to inject parameters with SQL syntax which was...CVE-2023-264397.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreExternal service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use...CVE-2023-264384.3 Medium
- ox software gmbh app suite, open-xchange appsuite backend, open-xchange gmbh ox app suite +2 moreAttackers with access to user accounts can inject arbitrary control characters to SIEVE mail...CVE-2023-264303.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...CVE-2023-264367.1 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIt was possible to call filesystem and network references using the local LibreOffice instance...CVE-2023-264355.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited...CVE-2023-264344.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited...CVE-2023-264334.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited...CVE-2023-264324.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt...CVE-2023-264315.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreControl characters were not removed when exporting user feedback content. This allowed attackers...CVE-2023-264293.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other...CVE-2023-264286.5 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDefault permissions for a properties file were too permissive. Local system users could read...CVE-2023-264273.2 Low
- open-xchange appsuiteOX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks...CVE-2022-373135.3 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body...CVE-2022-373125.3 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request...CVE-2022-373115.3 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module,...CVE-2022-373106.1 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail...CVE-2022-373096.1 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.CVE-2022-373086.1 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the...CVE-2022-373076.1 Medium
- open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app"...CVE-2022-314696.1 Medium
- open-xchange appsuiteOX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show...CVE-2022-298535.4 Medium
- open-xchange appsuiteOX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-298525.4 Medium
- open-xchange appsuiteOX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG...CVE-2021-266995.4 Medium
- Show moreLoading…