Open Xchange Appsuite vulnerabilities, page 5

157 vulnerabilities

Known vulnerabilities in Open Xchange Appsuite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3MediumCVE-2020-12643open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.EPSS0.62%9.8CriticalCVE-2020-12645open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption.EPSS1.07%5MediumCVE-2020-12644open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.EPSS0.69%7.5HighCVE-2020-8543open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite through 7.10.3 has Improper Input Validation.EPSS2.03%5.4MediumCVE-2020-8542open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite through 7.10.3 allows XSS.EPSS1.21%6.5MediumCVE-2020-8541open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite through 7.10.3 allows XXE attacks.EPSS1.04%6.5MediumCVE-2020-8544open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOX App Suite through 7.10.3 allows SSRF.EPSS1.06%4.3MediumCVE-2014-2077open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'.EPSS0.93%4.3MediumCVE-2014-2393open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.EPSS0.94%4.3MediumCVE-2014-2391open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteThe password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading (1) a web-server access log, (2) a web-server Referer log, or (3) browser history that contains this string because of its presence in a GET request.EPSS1.08%4.3MediumCVE-2014-2392open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteThe E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.EPSS1.08%5.3MediumCVE-2014-2078open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteThe backend in Open-Xchange (OX) AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts.EPSS1.27%4.3MediumCVE-2014-1679open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file.EPSS1.16%4MediumCVE-2014-9466open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteOpen-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."EPSS2.13%6.5MediumCVE-2014-7871open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteSQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.EPSS1.65%7.5HighCVE-2014-5236open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteMultiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.EPSS3.81%4.3MediumCVE-2014-5234open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name.EPSS1.94%4.3MediumCVE-2014-5235open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.EPSS1.94%7.8HighCVE-2014-5238open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteXML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.EPSS1.93%4.3MediumCVE-2014-8993open-xchange · open-xchange_appsuiteopen-xchange open-xchange_appsuiteCross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type.EPSS1.94%