Login Request a demo
OA
Product
Open-xchange Appsuite
by Open-xchange · last CVE Feb 12, 2024
157
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities157In the news0Timeline
Severity mix
Critical 7High 17Medium 101Low 2
Severity
All severities157Critical7High17Medium101Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Open-xchange Appsuite to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-16716
6.6
2%
Jan 6
OX App Suite through 7.10.2 has Incorrect Access Control
Affected: through 7.10.2
CVE-2023-41707
6.5
1%
Feb 12
Processing of user-defined mail search expressions is not limited
Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2023-41706
6.5
1%
Feb 12
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached
Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2023-41705
6.5
1%
Feb 12
Processing of user-defined DAV user-agent strings is not limited
Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2020-28943
6.5
1%
Apr 30
OX App Suite 7.10.4 and earlier allows SSRF via a snippet
Affected: through 7.10.4
CVE-2020-8544
6.5
1%
Jun 16
OX App Suite through 7.10.3 allows SSRF
Affected: 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; +34 more
CVE-2020-8541
6.5
1%
Jun 16
OX App Suite through 7.10.3 allows XXE attacks
Affected: 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; +10 more
CVE-2018-12609
6.5
1%
Jan 29
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery
Affected: through 7.8.4
CVE-2018-9998
6.5
2%
Jul 5
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which…
Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2018-5753
6.5
8%
Jun 16
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to…
Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2018-5751
6.5
9%
Jun 16
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated…
Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2017-17062
6.5
4%
Jun 16
The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated…
Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2021-23927
6.4
1%
Jan 12
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request
Affected: through 7.10.4
CVE-2023-41704
6.1
1%
Feb 12
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine
Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more
CVE-2023-41703
6.1
1%
Feb 12
User ID references at mentions in document comments were not correctly sanitized
Affected: before 7.10.6; after 7.10.6 before 8.20; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more
CVE-2023-29043
6.1
0%
Nov 2
Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document
Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more
CVE-2022-37310
6.1
1%
Dec 26
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI
Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more
CVE-2022-37309
6.1
1%
Dec 26
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name
Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more
CVE-2022-37308
6.1
1%
Dec 26
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages
Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more
CVE-2022-37307
6.1
1%
Dec 26
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature
Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more
CVE-2022-31469
6.1
1%
Dec 26
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI
Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more
CVE-2021-37403
6.1
1%
Jul 22
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative…
Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more
CVE-2021-37402
6.1
1%
Jul 22
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled
Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more
CVE-2021-26698
6.1
1%
Jul 22
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used
Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more
CVE-2020-28945
6.1
1%
May 3
OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constructor, in a Notes item
Affected: through 7.10.4
CVE-2021-31935
6.1
1%
Apr 30
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view
Affected: through 7.10.4
CVE-2021-31934
6.1
1%
Apr 30
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone
Affected: through 7.10.4
CVE-2021-23936
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via the subject of a task
Affected: through 7.10.4
CVE-2021-23935
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code
Affected: through 7.10.3
CVE-2021-23934
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code
Affected: through 7.10.3
CVE-2021-23933
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL
Affected: through 7.10.3
CVE-2021-23932
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename
Affected: through 7.10.3
CVE-2021-23931
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via an inline binary file
Affected: through 7.10.3
CVE-2021-23930
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile
Affected: through 7.10.3
CVE-2021-23929
6.1
1%
Jan 12
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI
Affected: through 7.10.3
CVE-2021-23928
6.1
1%
Jan 12
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string
Affected: through 7.10.3
CVE-2020-24701
6.1
7%
Jan 12
OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI)
Affected: through 7.10.4
CVE-2019-16717
6.1
2%
Jan 6
OX App Suite through 7.10.2 has XSS
Affected: through 7.10.2
CVE-2013-7486
6.1
2%
Jan 2
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject…
Affected: 7.2.2; 7.4.0
CVE-2013-7485
6.1
2%
Jan 2
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject…
Affected: 7.2.2; 7.4.0
CVE-2013-6242
6.1
2%
Jan 2
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject…
Affected: 6.22.3; 6.22.4; 7.2.2; 7.4.0
CVE-2019-14227
6.1
1%
Oct 14
OX App Suite 7.10.1 and 7.10.2 allows XSS
Affected: 7.10.1; 7.10.2
CVE-2017-5213
6.1
1%
May 23
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS)
Affected: through 7.8.3
CVE-2017-15030
6.1
1%
May 23
Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS)
Affected: through 7.8.4
CVE-2017-9808
6.1
1%
May 22
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS)
Affected: through 7.8.4
CVE-2017-5864
6.1
1%
May 22
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS)
Affected: through 7.8.3
CVE-2017-12885
6.1
1%
May 10
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS)
Affected: through 7.8.4
CVE-2018-12611
6.1
1%
Jan 29
OX App Suite 7.8.4 and earlier allows Directory Traversal
Affected: through 7.8.4
CVE-2017-6913
6.1
1%
Sep 18
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a…
Affected: through 7.6.3
CVE-2018-9997
6.1
2%
Jul 5
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before…
Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more
Page 1 of 3 · 101 total
123