Open Xchange vulnerabilities
277 vulnerabilities
Known vulnerabilities in Open Xchange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
Products
16- Open Xchange Appsuite157 vulnerabilities
- Ox App Suite48 vulnerabilities
- Dovecot16 vulnerabilities
- Open Xchange Appsuite Backend14 vulnerabilities
- Open Xchange Server13 vulnerabilities
- Ox Guard11 vulnerabilities
- Open Xchange Appsuite Frontend8 vulnerabilities
- Open Xchange Appsuite Office4 vulnerabilities
- Pdns4 vulnerabilities
- Open Xchange Documents3 vulnerabilities
- App Suite2 vulnerabilities
- Open Xchange2 vulnerabilities
- Dnsdist1 vulnerabilities
- Documentconverter Api1 vulnerabilities
- Office Web1 vulnerabilities
- Ox Cloud1 vulnerabilities
CVE-2018-13103open-xchangeopen-xchange_appsuite
EPSS score0.84%
OX App Suite 7.8.4 and earlier allows SSRF.CVE-2018-13104open-xchangeopen-xchange_appsuiteEPSS score0.77%
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)CVE-2018-9997open-xchangeopen-xchange_appsuiteEPSS score1.87%
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.CVE-2018-9998open-xchangeopen-xchange_appsuiteEPSS score1.81%
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.CVE-2018-5753open-xchangeopen-xchange_appsuiteEPSS score8.28%
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.CVE-2018-5754open-xchangeopen-xchange_appsuiteEPSS score2.98%
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.CVE-2018-5751open-xchangeopen-xchange_appsuiteEPSS score9.12%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.CVE-2018-5756open-xchangeopen-xchange_appsuiteEPSS score5.59%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.CVE-2018-5755open-xchangeopen-xchange_appsuiteEPSS score7.90%
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.CVE-2018-5752open-xchangeopen-xchange_appsuiteEPSS score4.56%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.CVE-2018-10986open-xchangeox_guardEPSS score0.46%
OX Guard 2.8.0 has CSRF.CVE-2018-12610open-xchangeopen-xchange_appsuiteEPSS score1.22%
OX App Suite 7.8.4 and earlier allows Information Exposure.CVE-2018-12611open-xchangeopen-xchange_appsuiteEPSS score1.21%
OX App Suite 7.8.4 and earlier allows Directory Traversal.CVE-2018-12609open-xchangeopen-xchange_appsuiteEPSS score1.02%
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.CVE-2013-2582open-xchangeopen-xchange_appsuite+1EPSS score1.05%
CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.CVE-2013-2583open-xchangeopen-xchange_appsuite+1EPSS score0.94%
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL, (2) malformed nested SCRIPT elements, (3) a mail signature, or (4) JavaScript code within an image file.CVE-2013-1645open-xchangeopen-xchange_serverEPSS score2.82%
Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the publication template path.CVE-2013-1647open-xchangeopen-xchange_serverEPSS score1.72%
Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter, as demonstrated by (1) the location parameter to ajax/redirect or (2) multiple infostore URIs.CVE-2013-1646open-xchangeopen-xchange_serverEPSS score1.33%
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via (1) invalid JSON data in a mail-sending POST request, (2) an arbitrary parameter to servlet/TestServlet, (3) a javascript: URL in a standalone-mode action to a UWA module, (4) an infostore attachment, (5) JavaScript code in a contact image, (6) an RSS feed, or (7) a signature.CVE-2013-1649open-xchangeopen-xchange_serverEPSS score1.89%
Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.