Skip to contentOx Software Gmbh App Suite vulnerabilities
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreImageconverter API endpoints provided methods that were not sufficiently validating and...CVE-2023-290475.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreConnections to external data sources, like e-mail autoconfiguration, were not terminated in case...CVE-2023-290464.3 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations, in this case "drawing", could be manipulated to contain invalid data types,...CVE-2023-290455.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDocuments operations could be manipulated to contain invalid data types, possibly script code....CVE-2023-290445.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 morePresentations may contain references to images, which are user-controlled, and could include...CVE-2023-290436.1 Medium
- open-xchange ox guard, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreUsers were able to set an arbitrary "product name" for OX Guard. The chosen value was not...CVE-2023-264565.4 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers...CVE-2023-264555.6 Medium
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to fetch image metadata could be abused to include SQL queries that would be executed...CVE-2023-264547.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image could be abused to include SQL queries that would be executed...CVE-2023-264537.6 High
- open-xchange appsuite, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreRequests to cache an image and return its metadata could be abused to include SQL queries that...CVE-2023-264527.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFunctions with insufficient randomness were used to generate authorization tokens of the...CVE-2023-264517.5 High
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Count" web service did not specify a media-type when processing responses by external...CVE-2023-264505.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "OX Chat" web service did not specify a media-type when processing responses by external...CVE-2023-264495.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCustom log-in and log-out locations are used-defined as jslob but were not checked to contain...CVE-2023-264485.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe "upsell" widget for the portal allows to specify a product description. This description...CVE-2023-264475.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe users clientID at "application passwords" was not sanitized or escaped before being added to...CVE-2023-264465.4 Medium
- open-xchange appsuite frontend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFrontend themes are defined by user-controllable jslob settings and could point to a malicious...CVE-2023-264455.4 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreFull-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements....CVE-2023-264435.5 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIn case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP...CVE-2023-264423.2 Low
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreCacheservice did not correctly check if relative cache object were pointing to the defined...CVE-2023-264415.7 Medium
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to indirectly inject parameters with SQL syntax which was...CVE-2023-264407.1 High
- open-xchange appsuite office, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreThe cacheservice API could be abused to inject parameters with SQL syntax which was...CVE-2023-264397.6 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreExternal service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use...CVE-2023-264384.3 Medium
- ox software gmbh app suite, open-xchange appsuite backend, open-xchange gmbh ox app suite +2 moreAttackers with access to user accounts can inject arbitrary control characters to SIEVE mail...CVE-2023-264303.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...CVE-2023-264367.1 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIt was possible to call filesystem and network references using the local LibreOffice instance...CVE-2023-264355.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited...CVE-2023-264344.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited...CVE-2023-264334.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited...CVE-2023-264324.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt...CVE-2023-264315.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreControl characters were not removed when exporting user feedback content. This allowed attackers...CVE-2023-264293.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other...CVE-2023-264286.5 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDefault permissions for a properties file were too permissive. Local system users could read...CVE-2023-264273.2 Low