Open-xchange Appsuite Backend vulnerabilities | LiveThreat CVE Feed

Product

Open-xchange Appsuite Backend

by Open-xchange · last CVE Aug 2, 2023

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 1High 2Medium 9Low 2

Severity

All severities14 Critical1 High2 Medium9 Low2

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Open-xchange Appsuite Backend to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-26428	6.5	1%	Jun 20	Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6
CVE-2016-6846	6.1	1%	Mar 29	Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before… Affected: 7.6.2; 7.8.0; 7.8.2
CVE-2023-26429	5.3	1%	Jun 20	Control characters were not removed when exporting user feedback content Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6
CVE-2023-26435	5.0	1%	Jun 20	It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents Affected: before 7.10.6; 7.10.6; 7.10.6
CVE-2023-26430	4.3	1%	Aug 2	Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules Affected: 7.10.6; 8.10.0
CVE-2023-26434	4.3	1%	Jun 20	When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 7.10.6; 7.10.6
CVE-2023-26433	4.3	1%	Jun 20	When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6
CVE-2023-26432	4.3	1%	Jun 20	When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6
CVE-2023-26431	4.3	1%	Jun 20	IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made Affected: before 7.10.6; 8.0.0 before 8.11.0; 7.10.6; 7.10.6