Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Vendors
Open-xchange

Open-xchange vulnerabilities

Products

Appsuite157
Ox App Suite48
Dovecot16
Appsuite Backend14
Server13
Ox Guard11
Appsuite Frontend8
Appsuite Office4
Pdns4
App Suite3
Documents3
Open-xchange2

Newest

Known exploitedIn KEVPublic exploitFix available

open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFrontend themes are defined by user-controllable jslob settings and could point to a malicious...CVE-2023-264455.4 MediumAugust 2, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements....CVE-2023-264435.5 MediumAugust 2, 2023
open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIn case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP...CVE-2023-264423.2 LowAugust 2, 2023
open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCacheservice did not correctly check if relative cache object were pointing to the defined...CVE-2023-264415.7 MediumAugust 2, 2023
open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to indirectly inject parameters with SQL syntax which was...CVE-2023-264407.1 HighAugust 2, 2023
open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to inject parameters with SQL syntax which was...CVE-2023-264397.6 HighAugust 2, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreExternal service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use...CVE-2023-264384.3 MediumAugust 2, 2023
ox software gmbh app suite, open-xchange appsuite backend, open-xchange gmbh ox app suite +2 moreAttackers with access to user accounts can inject arbitrary control characters to SIEVE mail...CVE-2023-264303.5 LowAugust 2, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...CVE-2023-264367.1 HighJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIt was possible to call filesystem and network references using the local LibreOffice instance...CVE-2023-264355.0 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited...CVE-2023-264344.3 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited...CVE-2023-264334.3 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited...CVE-2023-264324.3 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt...CVE-2023-264315.0 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreControl characters were not removed when exporting user feedback content. This allowed attackers...CVE-2023-264293.5 LowJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other...CVE-2023-264286.5 MediumJune 20, 2023
open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDefault permissions for a properties file were too permissive. Local system users could read...CVE-2023-264273.2 LowJune 20, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading...CVE-2023-246054.2 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g...CVE-2023-246044.3 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g.,...CVE-2023-246036.5 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such...CVE-2023-246026.1 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API...CVE-2023-246016.1 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls ...CVE-2023-246004.3 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of...CVE-2023-245994.3 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution...CVE-2023-245984.3 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail...CVE-2023-245975.3 MediumMay 29, 2023
open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.CVE-2022-373066.1 MediumApril 16, 2023
open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny...CVE-2022-436994.3 MediumApril 15, 2023
open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny...CVE-2022-436984.3 MediumApril 15, 2023
open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-436976.1 MediumApril 15, 2023
open-xchange ox app suiteOX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-436966.1 MediumApril 15, 2023
open-xchange appsuiteOX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks...CVE-2022-373135.3 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body...CVE-2022-373125.3 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request...CVE-2022-373115.3 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module,...CVE-2022-373106.1 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail...CVE-2022-373096.1 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.CVE-2022-373086.1 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the...CVE-2022-373076.1 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app"...CVE-2022-314696.1 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show...CVE-2022-298535.4 MediumDecember 26, 2022
open-xchange appsuiteOX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-298525.4 MediumDecember 26, 2022
open-xchange ox app suitedocumentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript...CVE-2022-298519.8 CriticalOctober 24, 2022
open-xchange ox app suiteOX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the...CVE-2022-314686.1 MediumOctober 24, 2022
open-xchange ox app suiteOX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable,...CVE-2022-244066.5 MediumJuly 27, 2022
open-xchange ox app suiteOX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the...CVE-2022-244059.8 CriticalJuly 27, 2022
open-xchange ox app suiteOX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.CVE-2022-231016.1 MediumJuly 27, 2022
open-xchange app suiteOX App Suite through 7.10.6 allows XSS by forcing block-wise read.CVE-2022-230995.4 MediumJuly 27, 2022
open-xchange ox app suiteOX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an...CVE-2022-231009.8 CriticalJuly 27, 2022
open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.CVE-2021-442136.1 MediumMarch 28, 2022
open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t...CVE-2021-442126.1 MediumMarch 28, 2022
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open