Open-Xchange
Page 2 of 3 — Open-Xchange CVEs from a corpus of 277, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44209 | Medium | 6.1 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. |
CVE-2021-44208 | Medium | 6.1 | 2022-03-28 | OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat. |
CVE-2021-38378 | Medium | 4.3 | 2021-11-22 | OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. |
CVE-2021-38377 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tra… |
CVE-2021-38376 | Medium | 5.3 | 2021-11-22 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. |
CVE-2021-38375 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. |
CVE-2021-38374 | Medium | 5.4 | 2021-11-22 | OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. |
CVE-2021-33495 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat system message. |
CVE-2021-33494 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. |
CVE-2021-33493 | Medium | 6.0 | 2021-11-22 | The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. |
CVE-2021-33492 | Medium | 6.1 | 2021-11-22 | OX App Suite 7.10.5 allows XSS via an OX Chat room name. |
CVE-2021-33491 | Medium | 6.5 | 2021-11-22 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses i… |
CVE-2021-33490 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. |
CVE-2021-33489 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. |
CVE-2021-33488 | Medium | 6.1 | 2021-11-22 | chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook. |
CVE-2021-28095 | Medium | 4.8 | 2021-07-30 | OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32. |
CVE-2021-28094 | Medium | 6.5 | 2021-07-30 | OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. |
CVE-2021-28093 | Medium | 6.5 | 2021-07-30 | OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. |
CVE-2021-37403 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an Ap… |
CVE-2021-37402 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been e… |
CVE-2021-26699 | Medium | 5.4 | 2021-07-22 | OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the… |
CVE-2021-26698 | Medium | 6.1 | 2021-07-22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the d… |
CVE-2020-28945 | Medium | 6.1 | 2021-05-03 | OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  that is mishandled in the scheduling view. |
CVE-2021-31934 | Medium | 6.1 | 2021-04-30 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a… |
CVE-2020-28944 | High | 7.5 | 2021-04-30 | OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. |
CVE-2020-28943 | Medium | 6.5 | 2021-04-30 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet. |
CVE-2021-23936 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via the subject of a task. |
CVE-2021-23935 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. |
CVE-2021-23934 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. |
CVE-2021-23933 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. |
CVE-2021-23932 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. |
CVE-2021-23931 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via an inline binary file. |
CVE-2021-23930 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. |
CVE-2021-23929 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI. |
CVE-2021-23928 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. |
CVE-2021-23927 | Medium | 6.4 | 2021-01-12 | OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. |
CVE-2020-24701 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). |
CVE-2020-24700 | Medium | 5.4 | 2021-01-12 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. |
CVE-2020-15004 | Medium | 4.8 | 2020-10-23 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. |
CVE-2020-15003 | Medium | 4.3 | 2020-10-23 | OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API… |
CVE-2020-15002 | Medium | 5.0 | 2020-10-23 | OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API. |
CVE-2020-12646 | Medium | 5.4 | 2020-08-31 | OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. |
CVE-2020-12645 | Critical | 9.8 | 2020-08-31 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory c… |
CVE-2020-12644 | Medium | 5.0 | 2020-08-31 | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API. |
CVE-2020-12643 | Medium | 4.3 | 2020-08-31 | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. |
CVE-2020-8544 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows SSRF. |
CVE-2020-8543 | High | 7.5 | 2020-06-16 | OX App Suite through 7.10.3 has Improper Input Validation. |
CVE-2020-8542 | Medium | 5.4 | 2020-06-16 | OX App Suite through 7.10.3 allows XSS. |
CVE-2020-8541 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows XXE attacks. |
CVE-2020-9427 | Medium | 5.0 | 2020-06-15 | OX Guard 2.10.3 and earlier allows SSRF. |
CVE-2020-9426 | Medium | 6.1 | 2020-06-15 | OX Guard 2.10.3 and earlier allows XSS. |
CVE-2019-18846 | Medium | 5.0 | 2020-02-21 | OX App Suite through 7.10.2 allows SSRF. |
CVE-2014-5236 | High | 7.5 | 2020-01-31 | Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remot… |
CVE-2014-5238 | High | 7.8 | 2020-01-14 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary… |
CVE-2019-16717 | Medium | 6.1 | 2020-01-06 | OX App Suite through 7.10.2 has XSS. |
CVE-2019-16716 | Medium | 6.6 | 2020-01-06 | OX App Suite through 7.10.2 has Incorrect Access Control. |
CVE-2013-7486 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attac… |
CVE-2013-7485 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attac… |
CVE-2013-6242 | Medium | 6.1 | 2020-01-02 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote a… |
CVE-2019-14227 | Medium | 6.1 | 2019-10-14 | OX App Suite 7.10.1 and 7.10.2 allows XSS. |
CVE-2019-14226 | High | 8.1 | 2019-10-14 | OX App Suite through 7.10.2 has Insecure Permissions. |
CVE-2019-14225 | Medium | 5.4 | 2019-10-14 | OX App Suite 7.10.1 and 7.10.2 allows SSRF. |
CVE-2019-11806 | Low | 3.3 | 2019-08-20 | OX App Suite 7.10.1 and earlier has Insecure Permissions. |
CVE-2019-11522 | Medium | 5.4 | 2019-08-20 | OX App Suite 7.10.0 to 7.10.2 allows XSS. |
CVE-2019-11521 | High | 8.1 | 2019-08-20 | OX App Suite 7.10.1 allows Content Spoofing. |
CVE-2018-10986 | High | 8.8 | 2019-07-03 | OX Guard 2.8.0 has CSRF. |
CVE-2019-7159 | High | 7.5 | 2019-06-18 | OX App Suite 7.10.1 and earlier allows Information Exposure. |
CVE-2019-7158 | Critical | 9.8 | 2019-06-17 | OX App Suite 7.10.0 and earlier has Incorrect Access Control. |
CVE-2017-13667 | Critical | 9.9 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. |
CVE-2017-13668 | Medium | 5.4 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-5213 | Medium | 6.1 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-5212 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. |
CVE-2017-5211 | High | 7.5 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2017-5210 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. |
CVE-2017-17061 | Medium | 5.4 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-17060 | Critical | 9.8 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. |
CVE-2017-15030 | Medium | 6.1 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-15029 | Medium | 4.3 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. |
CVE-2017-9808 | Medium | 6.1 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-8777 | High | 7.2 | 2019-05-22 | Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. |
CVE-2017-8341 | Medium | 5.3 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2017-8340 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-6912 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-5864 | Medium | 6.1 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-5863 | Critical | 9.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-9809 | Medium | 5.3 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-12884 | High | 7.5 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-12885 | Medium | 6.1 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2018-13104 | Medium | 5.4 | 2019-03-21 | OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID) |
CVE-2018-13103 | Medium | 5.4 | 2019-03-21 | OX App Suite 7.8.4 and earlier allows SSRF. |
CVE-2018-12611 | Medium | 6.1 | 2019-01-30 | OX App Suite 7.8.4 and earlier allows Directory Traversal. |
CVE-2018-12610 | Medium | 5.3 | 2019-01-30 | OX App Suite 7.8.4 and earlier allows Information Exposure. |
CVE-2018-12609 | Medium | 6.5 | 2019-01-30 | OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. |
CVE-2017-6913 | Medium | 6.1 | 2018-09-18 | Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2016-7074 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7073 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7069 | Medium | 5.9 | 2018-09-11 | An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to a… |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |