Read the docs

Open-Xchange GmbH

Records318All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical14CVSS 9.0–10.0
CVSS high49CVSS 7.0–8.9

Exploited now

Open-Xchange GmbH records in CISA KEV

No Open-Xchange GmbH vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Open-xchange Appsuite 157 records MEDIUM Ox App Suite 48 records MEDIUM Dovecot 16 records MEDIUM Open-xchange Appsuite Backend 14 records MEDIUM Open-xchange Server 13 records LOW Ox Guard 11 records MEDIUM Open-xchange Appsuite Frontend 8 records HIGH Open-xchange Appsuite Office 4 records LOW

Records

8 records in Open-xchange Appsuite Frontend · all components

TI-2024-04069 CVE-2024-4367 · GHSA-wgrm-67xf-hhpq

Improper check for unusual conditions in Mozilla Firefox

Priority HIGH 78

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.7066 Published 2024-05-14 Partial fix · 126, 115.11 +1 CWE-754
TI-2023-11597 CVE-2023-26450 · GHSA-9ppx-xr68-cm59

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 26

The "OX Count" web service did not specify a media-type when processing responses by external resources.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00725 Published 2023-08-02 No fix listed CWE-79
TI-2023-11596 CVE-2023-26449 · GHSA-hpjf-rjwg-v743

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 26

The "OX Chat" web service did not specify a media-type when processing responses by external resources.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00725 Published 2023-08-02 No fix listed CWE-79
TI-2023-11595 CVE-2023-26448 · GHSA-prhg-xpp4-c8mx

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 26

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00665 Published 2023-08-02 No fix listed CWE-79
TI-2023-11593 CVE-2023-26446 · GHSA-6vx9-wpjf-5pf7

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 26

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00665 Published 2023-08-02 No fix listed CWE-79
TI-2023-11592 CVE-2023-26445 · GHSA-ccm5-74vf-c7hj

Cross-site scripting in Open-Xchange GmbH OX App Suite

Priority LOW 26

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00665 Published 2023-08-02 No fix listed CWE-79
Open these records in search →