Open-Xchange
100 CVEs across 16 Open-Xchange products. Browse Open-Xchange vulnerabilities, severities, and proof-of-concept exploits.
Open-Xchange products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42006 | Medium | 4.3 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-40016 | Medium | 5.3 | 2026-05-12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the config… |
CVE-2026-33603 | Medium | 6.8 | 2026-05-12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to p… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-27860 | Low | 3.7 | 2026-03-27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restricti… |
CVE-2026-27859 | Medium | 5.3 | 2026-03-27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message causes mail delivery… |
CVE-2026-27858 | High | 7.5 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force manages… |
CVE-2026-27857 | Medium | 4.3 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This… |
CVE-2026-27856 | High | 7.4 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured cre… |
CVE-2026-27855 | Medium | 6.8 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP cred… |
CVE-2026-24031 | High | 7.7 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user… |
CVE-2026-0394 | Medium | 5.3 | 2026-03-27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characte… |
CVE-2025-59032 | High | 7.5 | 2026-03-27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unava… |
CVE-2025-59031 | Medium | 4.3 | 2026-03-27 | Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted… |
CVE-2025-59028 | Medium | 5.3 | 2026-03-27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 d… |
CVE-2024-4367 | High | 8.8 | 2024-05-14 | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Fire… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2023-41708 | Medium | 5.4 | 2024-02-12 | References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safegua… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2023-41710 | Medium | 5.4 | 2024-01-08 | User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victi… |
CVE-2023-29052 | Medium | 5.4 | 2024-01-08 | Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure vict… |
CVE-2023-29051 | High | 8.1 | 2024-01-08 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default… |
CVE-2023-29050 | High | 7.6 | 2024-01-08 | The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hi… |
CVE-2023-29049 | Medium | 5.4 | 2024-01-08 | The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain t… |
CVE-2023-29048 | High | 8.8 | 2024-01-08 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users an… |
CVE-2023-29047 | Medium | 5.3 | 2023-11-02 | Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. A… |
CVE-2023-29046 | Medium | 4.3 | 2023-11-02 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Som… |
CVE-2023-29045 | Medium | 5.4 | 2023-11-02 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an ope… |
CVE-2023-29044 | Medium | 5.4 | 2023-11-02 | Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be exec… |
CVE-2023-29043 | Medium | 6.1 | 2023-11-02 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a docum… |
CVE-2023-26456 | Medium | 5.4 | 2023-11-02 | Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, al… |
CVE-2023-26455 | Medium | 5.6 | 2023-11-02 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI serv… |
CVE-2023-26454 | High | 7.6 | 2023-11-02 | Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least acces… |
CVE-2023-26453 | High | 7.6 | 2023-11-02 | Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to a… |
CVE-2023-26452 | High | 7.6 | 2023-11-02 | Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requi… |
CVE-2023-26451 | High | 7.5 | 2023-08-02 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predi… |
CVE-2023-26450 | Medium | 5.4 | 2023-08-02 | The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victi… |
CVE-2023-26449 | Medium | 5.4 | 2023-08-02 | The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victim… |
CVE-2023-26448 | Medium | 5.4 | 2023-08-02 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be execute… |
CVE-2023-26447 | Medium | 5.4 | 2023-08-02 | The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before be… |
CVE-2023-26446 | Medium | 5.4 | 2023-08-02 | The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims… |
CVE-2023-26445 | Medium | 5.4 | 2023-08-02 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script cod… |
CVE-2023-26443 | Medium | 5.5 | 2023-08-02 | Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trig… |
CVE-2023-26442 | Low | 3.2 | 2023-08-02 | In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to… |
CVE-2023-26441 | Medium | 5.7 | 2023-08-02 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access… |
CVE-2023-26440 | High | 7.1 | 2023-08-02 | The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creati… |
CVE-2023-26439 | High | 7.6 | 2023-08-02 | The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attacker… |
CVE-2023-26438 | Medium | 4.3 | 2023-08-02 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers tha… |
CVE-2023-26430 | Low | 3.5 | 2023-08-02 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that… |
CVE-2023-26436 | High | 7.1 | 2023-06-20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Acce… |
CVE-2023-26435 | Medium | 5.0 | 2023-06-20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restri… |
CVE-2023-26434 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 serv… |
CVE-2023-26433 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP serv… |
CVE-2023-26432 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP serv… |
CVE-2023-26431 | Medium | 5.0 | 2023-06-20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use thi… |
CVE-2023-26429 | Low | 3.5 | 2023-06-20 | Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentiall… |
CVE-2023-26428 | Medium | 6.5 | 2023-06-20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could b… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |
CVE-2023-24605 | Medium | 4.2 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens. |
CVE-2023-24604 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unli… |
CVE-2023-24603 | Medium | 6.5 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited am… |
CVE-2023-24602 | Medium | 6.1 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title. |
CVE-2023-24601 | Medium | 6.1 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree. |
CVE-2023-24600 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book. |
CVE-2023-24599 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion… |
CVE-2023-24598 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of ano… |
CVE-2023-24597 | Medium | 5.3 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing. |
CVE-2022-37306 | Medium | 6.1 | 2023-04-16 | OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. |
CVE-2022-43699 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls th… |
CVE-2022-43698 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. |
CVE-2022-43697 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. |
CVE-2022-43696 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. |
CVE-2022-37310 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI. |
CVE-2022-37309 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. |
CVE-2022-29853 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. |
CVE-2022-29852 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. |
CVE-2022-37308 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. |
CVE-2022-37313 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
CVE-2022-37312 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. |
CVE-2022-37311 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. |
CVE-2022-37307 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. |
CVE-2022-31469 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. |
CVE-2022-31468 | Medium | 6.1 | 2022-10-25 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. |
CVE-2022-29851 | Critical | 9.8 | 2022-10-25 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occu… |
CVE-2022-24406 | Medium | 6.5 | 2022-07-27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter… |
CVE-2022-24405 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. |
CVE-2022-23101 | Medium | 6.1 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. |
CVE-2022-23100 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). |
CVE-2022-23099 | Medium | 5.4 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. |
CVE-2021-44213 | Medium | 6.1 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. |
CVE-2021-44212 | Medium | 6.1 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. |
CVE-2021-44211 | Medium | 5.4 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. |
CVE-2021-44210 | Medium | 6.1 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. |