OA
Product
Open-xchange Appsuite Backend
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 9Low 2
Watch
Add Open-xchange Appsuite Backend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-26443 | 9.8 | Aug 2 | Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements Affected: through 7.10.6; 8.10.0 through 8.12 |
| CVE-2023-26436 | 8.8 | Jun 20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization Affected: before 7.10.6; 7.10.6; 7.10.6 |
| CVE-2023-26451 | 7.5 | Aug 2 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service Affected: through 8.11.0 |
| CVE-2023-26428 | 6.5 | Jun 20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6 |
| CVE-2016-6846 | 6.1 | Mar 29 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before… Affected: 7.6.2; 7.8.0; 7.8.2 |
| CVE-2023-26429 | 5.3 | Jun 20 | Control characters were not removed when exporting user feedback content Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6 |
| CVE-2023-26435 | 5.0 | Jun 20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents Affected: before 7.10.6; 7.10.6; 7.10.6 |
| CVE-2023-26430 | 4.3 | Aug 2 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules Affected: 7.10.6; 8.10.0 |
| CVE-2023-26434 | 4.3 | Jun 20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 7.10.6; 7.10.6 |
| CVE-2023-26433 | 4.3 | Jun 20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6 |
| CVE-2023-26432 | 4.3 | Jun 20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6 |
| CVE-2023-26431 | 4.3 | Jun 20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6 |
| CVE-2023-26427 | 3.3 | Jun 20 | Default permissions for a properties file were too permissive Affected: before 7.10.6; 7.10.6; 7.10.6 |
| CVE-2023-26438 | 3.1 | Aug 2 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache Affected: 7.10.6; 8.10.0 |
Showing 14