Skip to contentOpen-xchange Ox App Suite vulnerabilities
- open-xchange ox app suiteE-Mails exported as PDF were stored in a cache that did not consider specific session information...CVE-2024-231935.3 Medium
- open-xchange ox app suiteContent-ID based embedding of resources in E-Mails could be abused to trigger client-side script...CVE-2024-231876.5 Medium
- open-xchange ox app suiteE-Mail containing malicious display-name information could trigger client-side script execution...CVE-2024-231866.5 Medium
- open-xchange ox app suiteUser-defined script code could be stored for a upsell related shop URL. This code was not...CVE-2023-417105.4 Medium
- open-xchange ox app suiteUsers were able to define disclaimer texts for an upsell shop dialog that would contain script...CVE-2023-290525.4 Medium
- open-xchange ox app suiteUser-defined OXMF templates could be used to access a limited part of the internal OX App Suite...CVE-2023-290518.1 High
- open-xchange ox app suiteThe optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter...CVE-2023-290507.6 High
- open-xchange ox app suiteThe "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers...CVE-2023-290495.4 Medium
- open-xchange ox app suiteA component for parsing OXMF templates could be abused to execute arbitrary system commands that...CVE-2023-290488.8 High
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading...CVE-2023-246054.2 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g...CVE-2023-246044.3 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g.,...CVE-2023-246036.5 Medium
- open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such...CVE-2023-246026.1 Medium
- open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API...CVE-2023-246016.1 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls ...CVE-2023-246004.3 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of...CVE-2023-245994.3 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution...CVE-2023-245984.3 Medium
- open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail...CVE-2023-245975.3 Medium
- open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.CVE-2022-373066.1 Medium
- open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny...CVE-2022-436994.3 Medium
- open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny...CVE-2022-436984.3 Medium
- open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-436976.1 Medium
- open-xchange ox app suiteOX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-436966.1 Medium
- open-xchange ox app suitedocumentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript...CVE-2022-298519.8 Critical
- open-xchange ox app suiteOX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the...CVE-2022-314686.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable,...CVE-2022-244066.5 Medium
- open-xchange ox app suiteOX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the...CVE-2022-244059.8 Critical
- open-xchange ox app suiteOX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.CVE-2022-231016.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an...CVE-2022-231009.8 Critical
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.CVE-2021-442136.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t...CVE-2021-442126.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail...CVE-2021-442115.4 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.CVE-2021-442106.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.CVE-2021-442096.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.CVE-2021-442086.1 Medium
- open-xchange ox app suiteOX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified...CVE-2021-383784.3 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within...CVE-2021-383776.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via...CVE-2021-383765.3 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e...CVE-2021-383756.1 Medium
- open-xchange ox app suiteOX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader...CVE-2021-383745.4 Medium
- open-xchange ox app suiteOX App Suite 7.10.5 allows XSS via an OX Chat system message.CVE-2021-334956.1 Medium
- open-xchange ox app suiteOX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-334946.1 Medium
- open-xchange ox app suiteThe middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in...CVE-2021-334936.0 Medium
- open-xchange ox app suiteOX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-334926.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive,...CVE-2021-334916.5 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.CVE-2021-334906.1 Medium
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.CVE-2021-334896.1 Medium
- open-xchange ox app suitechat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX...CVE-2021-334886.1 Medium