OA
Product
Open-xchange Appsuite
157
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 17Medium 101Low 2
Watch
Add Open-xchange Appsuite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-13668 | 5.4 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS) Affected: through 7.8.4 |
| CVE-2017-17061 | 5.4 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS) Affected: through 7.8.4 |
| CVE-2018-13104 | 5.4 | Mar 17 | OX App Suite 7.8.4 and earlier allows XSS Affected: through 7.8.4 |
| CVE-2018-13103 | 5.4 | Mar 17 | OX App Suite 7.8.4 and earlier allows SSRF Affected: through 7.8.4 |
| CVE-2018-5754 | 5.4 | Jun 16 | Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject… Affected: through 7.8.3; 7.8.3; 7.8.3; 7.8.3; 7.8.3; 7.8.3; +8 more |
| CVE-2016-3173 | 5.4 | Dec 15 | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27 Affected: through 7.8.0 |
| CVE-2022-37313 | 5.3 | Dec 26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37312 | 5.3 | Dec 26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37311 | 5.3 | Dec 26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2017-8341 | 5.3 | May 22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing Affected: through 7.8.3 |
| CVE-2017-9809 | 5.3 | May 22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure Affected: through 7.8.4 |
| CVE-2018-12610 | 5.3 | Jan 29 | OX App Suite 7.8.4 and earlier allows Information Exposure Affected: through 7.8.4 |
| CVE-2014-2078 | 5.3 | Apr 10 | The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances… Affected: 7.4.2 |
| CVE-2020-15002 | 5.0 | Oct 23 | OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API Affected: through 7.10.3 |
| CVE-2020-12644 | 5.0 | Aug 31 | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API Affected: through 7.10.3 |
| CVE-2019-18846 | 5.0 | Feb 21 | OX App Suite through 7.10.2 allows SSRF Affected: through 7.10.2 |
| CVE-2020-15004 | 4.8 | Oct 23 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS Affected: 7.10.2; 7.10.3 |
| CVE-2023-29046 | 4.3 | Nov 2 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2020-15003 | 4.3 | Oct 23 | OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive… Affected: 7.10.2; 7.10.3 |
| CVE-2020-12643 | 4.3 | Aug 31 | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address Affected: through 7.10.3 |
| CVE-2017-15029 | 4.3 | May 23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF Affected: through 7.8.4 |
| CVE-2018-5756 | 4.3 | Jun 16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2016-6852 | 4.3 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-4048 | 4.3 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11 Affected: through 7.8.1 |
| CVE-2016-4047 | 4.3 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8 Affected: through 7.8.1 |
| CVE-2016-4027 | 3.5 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10 Affected: through 7.8.1 |
| CVE-2019-11806 | 3.3 | Aug 20 | OX App Suite 7.10.1 and earlier has Insecure Permissions Affected: 7.6.3 through 7.10.1 |
| CVE-2015-5375 | – | Sep 28 | Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before… Affected: through 7.6.2 |
| CVE-2014-9466 | – | Feb 17 | Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows… Affected: 7.4.2; 7.6.0; 7.6.1 |
| CVE-2014-8993 | – | Jan 7 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote… Affected: through 7.4.2; 7.6.0; 7.6.1 |
| CVE-2014-1679 | – | Jan 5 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject… Affected: through 7.2.2; 7.4.0; 7.4.1 |
| CVE-2013-6241 | – | Dec 27 | The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly… Affected: 7.2.0; 7.2.1; 7.2.2; 7.4.0 |
| CVE-2014-7871 | – | Nov 21 | SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a… Affected: through 7.4.2; 7.6.0 |
| CVE-2014-5235 | – | Sep 17 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary… Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +5 more |
| CVE-2014-5234 | – | Sep 17 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary… Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +5 more |
| CVE-2014-2393 | – | Apr 24 | Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or… Affected: through 7.2.2; 7.2.0; 7.2.1; 7.4.1; 7.4.2 |
| CVE-2014-2392 | – | Apr 24 | The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which… Affected: through 7.2.2; 7.2.0; 7.2.1; 7.4.1; 7.4.2 |
| CVE-2014-2391 | – | Apr 24 | The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity… Affected: through 7.2.2; 7.2.0; 7.2.1; 7.4.1; 7.4.2 |
| CVE-2014-2077 | – | Mar 20 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject… Affected: 7.4.1; 7.4.2 |
| CVE-2013-7143 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +4 more |
| CVE-2013-7142 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API… Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +4 more |
| CVE-2013-7141 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors… Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +4 more |
| CVE-2013-7140 | – | Jan 26 | XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary… Affected: through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +4 more |
| CVE-2013-6997 | – | Jan 9 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML… Affected: through 7.4.0; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +3 more |
| CVE-2013-6074 | – | Nov 20 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script… Affected: 7.2.0; 7.2.1; 7.2.2; 7.4.0 |
| CVE-2013-6009 | – | Oct 3 | CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… Affected: through 7.2.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +1 more |
| CVE-2013-5690 | – | Oct 3 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content… Affected: through 7.2.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +1 more |
| CVE-2013-5936 | – | Sep 25 | The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime… Affected: 7.0.1; 7.0.2; 7.2.0; 7.2.1 |
| CVE-2013-5935 | – | Sep 25 | The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive… Affected: 7.0.1; 7.0.2; 7.2.0; 7.2.1 |
| CVE-2013-5934 | – | Sep 25 | Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by… Affected: 7.0.1; 7.0.2; 7.2.0; 7.2.1 |