Open Xchange vulnerabilities, page 3
277 vulnerabilities
Known vulnerabilities in Open Xchange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
CVE-2013-6009open-xchangeopen-xchange_appsuite
EPSS score0.96%
CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet.CVE-2013-6242open-xchangeopen-xchange_appsuiteEPSS score1.63%
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.CVE-2013-3106open-xchangeopen-xchange_appsuite+1EPSS score0.94%
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via (1) embedded VBScript, (2) object/data Base64 content, (3) a Content-Type header, or (4) UTF-16 encoding, aka Bug IDs 25957, 26237, 26243, and 26244.CVE-2021-26699open-xchangeopen-xchange_appsuiteEPSS score2.00%
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.CVE-2021-26698open-xchangeopen-xchange_appsuiteEPSS score1.43%
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.CVE-2021-31935open-xchangeopen-xchange_appsuiteEPSS score0.94%
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view.CVE-2021-31934open-xchangeopen-xchange_appsuiteEPSS score0.94%
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.CVE-2021-37402open-xchangeopen-xchange_appsuiteEPSS score0.79%
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.CVE-2021-37403open-xchangeopen-xchange_appsuiteEPSS score0.79%
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.CVE-2021-38376open-xchangeox_app_suiteEPSS score1.49%
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.CVE-2021-38377open-xchangeox_app_suiteEPSS score1.16%
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.CVE-2021-38375open-xchangeox_app_suiteEPSS score1.36%
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.CVE-2021-38374open-xchangeox_app_suiteEPSS score1.25%
OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.CVE-2021-38378open-xchangeox_app_suiteEPSS score1.25%
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.CVE-2021-44211open-xchangeox_app_suiteEPSS score0.66%
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.CVE-2021-44209open-xchangeox_app_suiteEPSS score0.90%
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.CVE-2021-44212open-xchangeox_app_suiteEPSS score0.93%
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.CVE-2021-44213open-xchangeox_app_suiteEPSS score0.93%
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.CVE-2021-44208open-xchangeox_app_suiteEPSS score0.90%
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.CVE-2021-44210open-xchangeox_app_suiteEPSS score0.91%
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.