Open Xchange Appsuite vulnerabilities
157 vulnerabilities
Known vulnerabilities in Open Xchange Appsuite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-13103open-xchangeopen-xchange_appsuite
EPSS score0.84%
OX App Suite 7.8.4 and earlier allows SSRF.CVE-2018-13104open-xchangeopen-xchange_appsuiteEPSS score0.77%
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)CVE-2018-9997open-xchangeopen-xchange_appsuiteEPSS score1.87%
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.CVE-2018-9998open-xchangeopen-xchange_appsuiteEPSS score1.81%
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.CVE-2018-5753open-xchangeopen-xchange_appsuiteEPSS score8.28%
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.CVE-2018-5754open-xchangeopen-xchange_appsuiteEPSS score2.98%
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.CVE-2018-5751open-xchangeopen-xchange_appsuiteEPSS score9.12%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.CVE-2018-5756open-xchangeopen-xchange_appsuiteEPSS score5.59%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.CVE-2018-5755open-xchangeopen-xchange_appsuiteEPSS score7.90%
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.CVE-2018-5752open-xchangeopen-xchange_appsuiteEPSS score4.56%
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.CVE-2018-12610open-xchangeopen-xchange_appsuiteEPSS score1.22%
OX App Suite 7.8.4 and earlier allows Information Exposure.CVE-2018-12611open-xchangeopen-xchange_appsuiteEPSS score1.21%
OX App Suite 7.8.4 and earlier allows Directory Traversal.CVE-2018-12609open-xchangeopen-xchange_appsuiteEPSS score1.02%
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.CVE-2013-2582open-xchangeopen-xchange_appsuite+1EPSS score1.05%
CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.CVE-2013-2583open-xchangeopen-xchange_appsuite+1EPSS score0.94%
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL, (2) malformed nested SCRIPT elements, (3) a mail signature, or (4) JavaScript code within an image file.CVE-2013-4790open-xchangeopen-xchange_appsuiteEPSS score0.93%
Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in opportunistic circumstances via a manual-mode association of a personal e-mail address with the hostname of a crafted IMAP server.CVE-2013-7140open-xchangeopen-xchange_appsuiteEPSS score1.78%
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.CVE-2013-7141open-xchangeopen-xchange_appsuiteEPSS score1.79%
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to crafted "<%" tags.CVE-2013-7485open-xchangeopen-xchange_appsuiteEPSS score1.76%
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.CVE-2013-7486open-xchangeopen-xchange_appsuiteEPSS score1.63%
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.