OA
Product
Open-xchange Appsuite
157
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 17Medium 101Low 2
Watch
Add Open-xchange Appsuite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-13667 | 9.9 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF Affected: through 7.8.4 |
| CVE-2020-12645 | 9.8 | Aug 31 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption Affected: 7.10.1 through 7.10.3 |
| CVE-2019-7158 | 9.8 | Jun 17 | OX App Suite 7.10.0 and earlier has Incorrect Access Control Affected: through 7.10.0 |
| CVE-2017-5212 | 9.8 | May 23 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control Affected: 7.8.3 |
| CVE-2017-5210 | 9.8 | May 23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure Affected: through 7.8.3 |
| CVE-2017-17060 | 9.8 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions Affected: through 7.8.4 |
| CVE-2017-5863 | 9.8 | May 22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control Affected: through 7.8.3 |
| CVE-2023-26454 | 8.8 | Nov 2 | Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-26453 | 8.8 | Nov 2 | Requests to cache an image could be abused to include SQL queries that would be executed unchecked Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-26452 | 8.8 | Nov 2 | Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2017-8340 | 8.8 | May 22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control Affected: through 7.8.3 |
| CVE-2017-6912 | 8.8 | May 22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control Affected: through 7.8.3 |
| CVE-2018-5752 | 8.8 | Jun 16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2019-14226 | 8.1 | Oct 14 | OX App Suite through 7.10.2 has Insecure Permissions Affected: through 7.10.2 |
| CVE-2019-11521 | 8.1 | Aug 20 | OX App Suite 7.10.1 allows Content Spoofing Affected: 7.10.1 |
| CVE-2023-26455 | 7.8 | Nov 2 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2014-5238 | 7.8 | Jan 14 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly… Affected: through 7.4.1; 7.4.2; 7.4.2; 7.4.2; 7.4.2; 7.4.2; +15 more |
| CVE-2020-8543 | 7.5 | Jun 16 | OX App Suite through 7.10.3 has Improper Input Validation Affected: 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; +34 more |
| CVE-2014-5236 | 7.5 | Jan 31 | Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read… Affected: through 7.4.1; 7.4.2; 7.4.2; 7.4.2; 7.4.2; 7.4.2; +15 more |
| CVE-2019-7159 | 7.5 | Jun 18 | OX App Suite 7.10.1 and earlier allows Information Exposure Affected: through 7.10.1 |
| CVE-2017-5211 | 7.5 | May 23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing Affected: through 7.8.3 |
| CVE-2017-12884 | 7.5 | May 10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure Affected: through 7.8.4 |
| CVE-2016-3174 | 7.4 | Dec 15 | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27 Affected: through 7.8.0 |
| CVE-2023-29047 | 7.3 | Nov 2 | Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2019-16716 | 6.6 | Jan 6 | OX App Suite through 7.10.2 has Incorrect Access Control Affected: through 7.10.2 |
| CVE-2023-41707 | 6.5 | Feb 12 | Processing of user-defined mail search expressions is not limited Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2023-41706 | 6.5 | Feb 12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2023-41705 | 6.5 | Feb 12 | Processing of user-defined DAV user-agent strings is not limited Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2020-28943 | 6.5 | Apr 30 | OX App Suite 7.10.4 and earlier allows SSRF via a snippet Affected: through 7.10.4 |
| CVE-2020-8544 | 6.5 | Jun 16 | OX App Suite through 7.10.3 allows SSRF Affected: 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; 7.8.4; +34 more |
| CVE-2020-8541 | 6.5 | Jun 16 | OX App Suite through 7.10.3 allows XXE attacks Affected: 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; +10 more |
| CVE-2018-12609 | 6.5 | Jan 29 | OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery Affected: through 7.8.4 |
| CVE-2018-9998 | 6.5 | Jul 5 | Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2018-5753 | 6.5 | Jun 16 | The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2018-5751 | 6.5 | Jun 16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2017-17062 | 6.5 | Jun 16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2021-23927 | 6.4 | Jan 12 | OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request Affected: through 7.10.4 |
| CVE-2023-41704 | 6.1 | Feb 12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine Affected: before 7.6.3; after 7.6.3 before 7.10.6; after 7.10.6 before 8.20; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2023-41703 | 6.1 | Feb 12 | User ID references at mentions in document comments were not correctly sanitized Affected: before 7.10.6; after 7.10.6 before 8.20; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-29043 | 6.1 | Nov 2 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2022-37310 | 6.1 | Dec 26 | OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37309 | 6.1 | Dec 26 | OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37308 | 6.1 | Dec 26 | OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37307 | 6.1 | Dec 26 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-31469 | 6.1 | Dec 26 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2021-37403 | 6.1 | Jul 22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative… Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more |
| CVE-2021-37402 | 6.1 | Jul 22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more |
| CVE-2021-26698 | 6.1 | Jul 22 | OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more |
| CVE-2020-28945 | 6.1 | May 3 | OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  that is mishandled in the scheduling view Affected: through 7.10.4 |