Open-xchange Open-xchange_appsuite_backend
14 CVEs affecting Open-xchange Open-xchange_appsuite_backend. Latest disclosed: 2023-08-02. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26451 | High | 7.5 | 2023-08-02 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predi… |
CVE-2023-26436 | High | 7.1 | 2023-06-20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Acce… |
CVE-2023-26428 | Medium | 6.5 | 2023-06-20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could b… |
CVE-2016-6846 | Medium | 6.1 | 2017-03-29 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite… |
CVE-2023-26443 | Medium | 5.5 | 2023-08-02 | Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trig… |
CVE-2023-26435 | Medium | 5.0 | 2023-06-20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restri… |
CVE-2023-26431 | Medium | 5.0 | 2023-06-20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use thi… |
CVE-2023-26438 | Medium | 4.3 | 2023-08-02 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers tha… |
CVE-2023-26434 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 serv… |
CVE-2023-26433 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP serv… |
CVE-2023-26432 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP serv… |
CVE-2023-26430 | Low | 3.5 | 2023-08-02 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that… |
CVE-2023-26429 | Low | 3.5 | 2023-06-20 | Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentiall… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |