Open Xchange Appsuite vulnerabilities, page 3
157 vulnerabilities
Known vulnerabilities in Open Xchange Appsuite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-37403open-xchangeopen-xchange_appsuite
EPSS score0.79%
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.CVE-2021-23929open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.CVE-2021-23927open-xchangeopen-xchange_appsuiteEPSS score0.77%
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.CVE-2021-23932open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.CVE-2021-23934open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.CVE-2021-23933open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.CVE-2021-23931open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via an inline binary file.CVE-2021-23936open-xchangeopen-xchange_appsuiteEPSS score0.93%
OX App Suite through 7.10.4 allows XSS via the subject of a task.CVE-2021-23935open-xchangeopen-xchange_appsuiteEPSS score1.09%
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.CVE-2021-23930open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.CVE-2021-23928open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.CVE-2015-1588open-xchangeopen-xchange_appsuite+1EPSS score1.54%
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.CVE-2015-5375open-xchangeopen-xchange_appsuite+1EPSS score1.95%
Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to object properties.CVE-2016-2840open-xchangeopen-xchange_appsuiteEPSS score1.64%
An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context. While no OX App Suite specific data can be manipulated, the vulnerability can be exploited without being authenticated and therefore used for social engineering attacks, stealing cookies or redirecting from trustworthy to malicious hosts.CVE-2016-4046open-xchangeopen-xchange_appsuiteEPSS score1.19%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks.CVE-2016-4047open-xchangeopen-xchange_appsuiteEPSS score0.82%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed.CVE-2016-4026open-xchangeopen-xchange_appsuiteEPSS score0.71%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Attackers can use this issue for filter evasion to inject script code later on.CVE-2016-4027open-xchangeopen-xchange_appsuiteEPSS score1.07%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However the setting was incorrectly recognized and cookies were stored regardless of this setting when the login was performed using a non-interactive login method. In case the setting was enforced by middleware configuration or the user went through the interactive login page, the workflow was correct. Cookies with authentication information may become available to other users on shared environments. In case the user did not properly log out from the session, third parties with access to the same client can access a user's account.CVE-2016-4045open-xchangeopen-xchange_appsuiteEPSS score0.71%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). The attacker needs to reside within the same context to make this attack work.CVE-2016-4048open-xchangeopen-xchange_appsuiteEPSS score1.16%
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks.