OA
Product
Open-xchange Appsuite
157
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 17Medium 101Low 2
Watch
Add Open-xchange Appsuite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-1588 | 6.1 | Jun 8 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21 Affected: through 7.4.2; 7.6.0; 7.6.1 |
| CVE-2016-6850 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-6847 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-6845 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-6844 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-6843 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-6842 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-5740 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5 Affected: through 7.8.2 |
| CVE-2016-5124 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14 Affected: through 7.8.1 |
| CVE-2016-4045 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11 Affected: through 7.8.1 |
| CVE-2016-4026 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11 Affected: through 7.8.1 |
| CVE-2016-2840 | 6.1 | Dec 15 | An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26 Affected: through 7.8.0 |
| CVE-2016-4046 | 5.8 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11 Affected: through 7.8.1 |
| CVE-2018-5755 | 5.5 | Jun 16 | Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4… Affected: through 7.6.3; 7.8.0; 7.8.2; 7.8.3; 7.8.4; 7.8.4 |
| CVE-2016-6848 | 5.5 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2023-41708 | 5.4 | Feb 12 | References to the "app loader" functionality could contain redirects to unexpected locations Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-29045 | 5.4 | Nov 2 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2023-29044 | 5.4 | Nov 2 | Documents operations could be manipulated to contain invalid data types, possibly script code Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2022-29853 | 5.4 | Dec 26 | OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-29852 | 5.4 | Dec 26 | OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked Affected: before 7.10.5; 8.2 before 8.2.324; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2021-26699 | 5.4 | Jul 22 | OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is… Affected: 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; 7.10.3; +34 more |
| CVE-2020-24700 | 5.4 | Jan 12 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig Affected: through 7.10.3 |
| CVE-2020-12646 | 5.4 | Aug 31 | OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document Affected: through 7.10.3 |
| CVE-2020-8542 | 5.4 | Jun 16 | OX App Suite through 7.10.3 allows XSS Affected: 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; 7.10.1; +34 more |
| CVE-2019-14225 | 5.4 | Oct 14 | OX App Suite 7.10.1 and 7.10.2 allows SSRF Affected: 7.10.1; 7.10.2 |
| CVE-2019-11522 | 5.4 | Aug 20 | OX App Suite 7.10.0 to 7.10.2 allows XSS Affected: 7.10.0 through 7.10.2 |
| CVE-2017-13668 | 5.4 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS) Affected: through 7.8.4 |
| CVE-2017-17061 | 5.4 | May 23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS) Affected: through 7.8.4 |
| CVE-2018-13104 | 5.4 | Mar 17 | OX App Suite 7.8.4 and earlier allows XSS Affected: through 7.8.4 |
| CVE-2018-13103 | 5.4 | Mar 17 | OX App Suite 7.8.4 and earlier allows SSRF Affected: through 7.8.4 |
| CVE-2018-5754 | 5.4 | Jun 16 | Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject… Affected: through 7.8.3; 7.8.3; 7.8.3; 7.8.3; 7.8.3; 7.8.3; +8 more |
| CVE-2016-3173 | 5.4 | Dec 15 | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27 Affected: through 7.8.0 |
| CVE-2022-37311 | 5.3 | Dec 26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37312 | 5.3 | Dec 26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2022-37313 | 5.3 | Dec 26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record Affected: before 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; 7.10.5; +34 more |
| CVE-2017-8341 | 5.3 | May 22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing Affected: through 7.8.3 |
| CVE-2017-9809 | 5.3 | May 22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure Affected: through 7.8.4 |
| CVE-2018-12610 | 5.3 | Jan 29 | OX App Suite 7.8.4 and earlier allows Information Exposure Affected: through 7.8.4 |
| CVE-2014-2078 | 5.3 | Apr 10 | The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances… Affected: 7.4.2 |
| CVE-2020-15002 | 5.0 | Oct 23 | OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API Affected: through 7.10.3 |
| CVE-2020-12644 | 5.0 | Aug 31 | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API Affected: through 7.10.3 |
| CVE-2019-18846 | 5.0 | Feb 21 | OX App Suite through 7.10.2 allows SSRF Affected: through 7.10.2 |
| CVE-2020-15004 | 4.8 | Oct 23 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS Affected: 7.10.2; 7.10.3 |
| CVE-2023-29046 | 4.3 | Nov 2 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged Affected: before 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; 7.10.6; +34 more |
| CVE-2020-15003 | 4.3 | Oct 23 | OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive… Affected: 7.10.2; 7.10.3 |
| CVE-2020-12643 | 4.3 | Aug 31 | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address Affected: through 7.10.3 |
| CVE-2017-15029 | 4.3 | May 23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF Affected: through 7.8.4 |
| CVE-2018-5756 | 4.3 | Jun 16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for… Affected: through 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; 7.6.3; +34 more |
| CVE-2016-6852 | 4.3 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8 Affected: through 7.8.2 |
| CVE-2016-4048 | 4.3 | Dec 15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11 Affected: through 7.8.1 |