Vulnerabilities (CVE)

Filtered by vendor Open-xchange Subscribe
Filtered by product Open-xchange Appsuite
Total 128 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-8341 1 Open-xchange 1 Open-xchange Appsuite 2019-05-23 5.0 MEDIUM 5.3 MEDIUM
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVE-2017-9808 1 Open-xchange 1 Open-xchange Appsuite 2019-05-23 4.3 MEDIUM 6.1 MEDIUM
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2017-8340 1 Open-xchange 1 Open-xchange Appsuite 2019-05-23 6.5 MEDIUM 8.8 HIGH
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVE-2017-12884 1 Open-xchange 1 Open-xchange Appsuite 2019-05-10 5.0 MEDIUM 7.5 HIGH
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
CVE-2017-12885 1 Open-xchange 1 Open-xchange Appsuite 2019-05-10 4.3 MEDIUM 6.1 MEDIUM
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2014-2078 1 Open-xchange 1 Open-xchange Appsuite 2019-04-26 5.0 MEDIUM 5.3 MEDIUM
The backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts.
CVE-2018-13103 1 Open-xchange 1 Open-xchange Appsuite 2019-03-27 5.5 MEDIUM 5.4 MEDIUM
OX App Suite 7.8.4 and earlier allows SSRF.
CVE-2018-13104 1 Open-xchange 1 Open-xchange Appsuite 2019-03-26 3.5 LOW 5.4 MEDIUM
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)
CVE-2018-12611 1 Open-xchange 1 Open-xchange Appsuite 2019-01-31 4.3 MEDIUM 6.1 MEDIUM
OX App Suite 7.8.4 and earlier allows Directory Traversal.
CVE-2018-12610 1 Open-xchange 1 Open-xchange Appsuite 2019-01-31 5.0 MEDIUM 5.3 MEDIUM
OX App Suite 7.8.4 and earlier allows Information Exposure.
CVE-2018-12609 1 Open-xchange 1 Open-xchange Appsuite 2019-01-31 4.0 MEDIUM 6.5 MEDIUM
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
CVE-2017-6913 1 Open-xchange 1 Open-xchange Appsuite 2018-11-08 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag.
CVE-2016-5124 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially crafted website and add it to HTML editor areas of OX App Suite, for example E-Mail Compose or OX Text. This specific attack circumvents typical XSS filters and detection mechanisms since the code is not loaded from an external service but injected locally. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). To exploit this vulnerability, a attacker needs to convince a user to follow specific steps (social-engineering).
CVE-2016-4027 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 3.5 LOW 3.5 LOW
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However the setting was incorrectly recognized and cookies were stored regardless of this setting when the login was performed using a non-interactive login method. In case the setting was enforced by middleware configuration or the user went through the interactive login page, the workflow was correct. Cookies with authentication information may become available to other users on shared environments. In case the user did not properly log out from the session, third parties with access to the same client can access a user's account.
CVE-2016-4045 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). The attacker needs to reside within the same context to make this attack work.
CVE-2016-4046 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 5.0 MEDIUM 5.8 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.
CVE-2016-4047 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 4.0 MEDIUM 4.3 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed.
CVE-2016-4048 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 4.3 MEDIUM 4.3 MEDIUM
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks.
CVE-2016-2840 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context. While no OX App Suite specific data can be manipulated, the vulnerability can be exploited without being authenticated and therefore used for social engineering attacks, stealing cookies or redirecting from trustworthy to malicious hosts.
CVE-2016-3173 1 Open-xchange 1 Open-xchange Appsuite 2018-10-19 3.5 LOW 5.4 MEDIUM
An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file (e.g. an image) which gets displayed at the portal application. Using script code at the file name leads to script execution. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Users actively need to add a file to the portal to enable this attack. In case of shared files however, a internal attacker may modify a previously embedded file to carry a malicious file name. Furthermore this vulnerability can be used to persistently execute code that got injected by a temporary script execution vulnerability.