Open-Xchange Gmbh Ox App Suite
27 CVEs affecting Open-Xchange Gmbh Ox App Suite. Latest disclosed: 2025-11-27. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29048 | High | 8.8 | 2024-01-08 | A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users an… |
CVE-2023-29051 | High | 8.1 | 2024-01-08 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default… |
CVE-2023-29050 | High | 7.6 | 2024-01-08 | The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hi… |
CVE-2025-30188 | High | 7.5 | 2025-10-31 | Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the w… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2024-23188 | Medium | 6.5 | 2024-05-06 | Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interacti… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2024-23192 | Medium | 6.1 | 2024-04-08 | RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or succes… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-30191 | Medium | 5.4 | 2025-10-31 | Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information t… |
CVE-2024-25582 | Medium | 5.4 | 2024-08-19 | Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or e… |
CVE-2024-23191 | Medium | 5.4 | 2024-04-08 | Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attack… |