Open-Xchange GmbH

Records318All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high49CVSS 7.0–8.9

Exploited now

Open-Xchange GmbH records in CISA KEV

No Open-Xchange GmbH vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Open-xchange Appsuite 157 records MEDIUM Ox App Suite 48 records MEDIUM Dovecot 16 records MEDIUM Open-xchange Appsuite Backend 14 records MEDIUM Open-xchange Server 13 records LOW Ox Guard 11 records MEDIUM Open-xchange Appsuite Frontend 8 records HIGH Open-xchange Appsuite Office 4 records LOW

Records

48 records in Ox App Suite · all components

TI-2022-17387 CVE-2022-37306 · GHSA-mfrv-jgvv-x4mc

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.

MEDIUM 60

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00568 Published 2023-04-16 No fix listed CWE-79

TI-2022-12211 CVE-2022-29851 · GHSA-5wgq-vg66-44cm

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with…

MEDIUM 55

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0381 Published 2022-10-24 No fix listed CWE-78

TI-2022-08281 CVE-2022-24405 · GHSA-jjq6-7gx6-74fc

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.

MEDIUM 48

OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03142 Published 2022-07-27 No fix listed CWE-78

TI-2022-07269 CVE-2022-23100 · GHSA-33vj-x2w7-j3gv

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).

MEDIUM 48

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02996 Published 2022-07-27 No fix listed CWE-78

TI-2023-13500 CVE-2023-29050 · GHSA-4p4p-22cr-2gqw

LDAP injection in Open-Xchange GmbH OX App Suite

MEDIUM 45

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01668 Published 2024-01-08 No fix listed CWE-90

TI-2023-13498 CVE-2023-29048 · GHSA-2w87-fjj9-j39h

OS command injection in Open-Xchange GmbH OX App Suite

MEDIUM 43

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2024-01-08 No fix listed CWE-78

TI-2023-13501 CVE-2023-29051 · GHSA-hwrv-r72x-jcwr

Improper access control in Open-Xchange GmbH OX App Suite

LOW 36

User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00546 Published 2024-01-08 No fix listed CWE-284

TI-2021-12893 CVE-2021-33491 · GHSA-jcf7-7gj6-2qmr

OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP…

LOW 34

OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02516 Published 2021-11-22 No fix listed CWE-22

TI-2023-10213 CVE-2023-24597 · GHSA-43wr-9394-fxp2

OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an…

LOW 31

OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00546 Published 2023-05-29 No fix listed

TI-2022-08282 CVE-2022-24406 · GHSA-mqpc-v236-v2qj

OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are…

LOW 31

OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00985 Published 2022-07-27 No fix listed CWE-330

TI-2024-15298 CVE-2024-23186 · GHSA-c44v-j563-f268

Cross-site scripting in Open-Xchange GmbH OX App Suite

LOW 30

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00575 Published 2024-05-06 No fix listed CWE-79

TI-2023-13499 CVE-2023-29049 · GHSA-pgpx-675x-4jcv

Cross-site scripting in Open-Xchange GmbH OX App Suite

LOW 30

The "upsell" widget at the portal page could be abused to inject arbitrary script code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00642 Published 2024-01-08 No fix listed CWE-79

TI-2023-10219 CVE-2023-24603 · GHSA-h6p2-9x8r-w2mx

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading…

LOW 30

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00759 Published 2023-05-29 No fix listed

TI-2021-15981 CVE-2021-38377 · GHSA-jm3c-54xp-46qx

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment…

LOW 30

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01156 Published 2021-11-22 No fix listed CWE-330

TI-2021-15979 CVE-2021-38375 · GHSA-fvhr-wmw2-fg68

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.

LOW 30

OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01364 Published 2021-11-22 No fix listed CWE-79

TI-2021-12896 CVE-2021-33494 · GHSA-x3ff-jr5f-cm7q

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.

LOW 30

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01149 Published 2021-11-22 No fix listed CWE-79

TI-2021-12894 CVE-2021-33492 · GHSA-qwxw-chmh-gpjc

OX App Suite 7.10.5 allows XSS via an OX Chat room name.

LOW 30

OX App Suite 7.10.5 allows XSS via an OX Chat room name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01149 Published 2021-11-22 No fix listed CWE-79

TI-2021-12892 CVE-2021-33490 · GHSA-3qm9-v325-gx6g

OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.

LOW 30

OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01303 Published 2021-11-22 No fix listed CWE-79

TI-2021-12891 CVE-2021-33489 · GHSA-594j-f97m-jvvm

OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.

LOW 30

OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01303 Published 2021-11-22 No fix listed CWE-79

TI-2021-12890 CVE-2021-33488 · GHSA-wmjg-j8m2-29c4

chat in OX App Suite 7.10.5 has Improper Input Validation.

LOW 30

chat in OX App Suite 7.10.5 has Improper Input Validation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01151 Published 2021-11-22 No fix listed CWE-20

TI-2024-15299 CVE-2024-23187 · GHSA-2r8w-gh9h-q7vh

Cross-site scripting in Open-Xchange GmbH OX App Suite

LOW 29

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00485 Published 2024-05-06 No fix listed CWE-79

TI-2021-19907 CVE-2021-44213 · GHSA-469f-8q7q-fm6q

OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.

LOW 29

OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00933 Published 2022-03-28 No fix listed CWE-79

TI-2021-19906 CVE-2021-44212 · GHSA-pjw9-wrjm-7xgw

OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.

LOW 29

OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00933 Published 2022-03-28 No fix listed CWE-79

TI-2021-19904 CVE-2021-44210 · GHSA-ww96-r8xw-5538

OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.

LOW 29

OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00913 Published 2022-03-28 No fix listed CWE-79

TI-2021-19903 CVE-2021-44209 · GHSA-jrxm-22xm-3mc3

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.

LOW 29

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00903 Published 2022-03-28 No fix listed CWE-79

Open these records in search →

Critical	14
High	49
Medium	242
Low	13
No CVSS	0