Open Xchange vulnerabilities, page 4
277 vulnerabilities
Known vulnerabilities in Open Xchange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
CVE-2021-28093open-xchangeopen-xchange_documents
EPSS score1.07%
OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.CVE-2021-28095open-xchangeopen-xchange_documentsEPSS score0.90%
OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32.CVE-2021-28094open-xchangeopen-xchange_documentsEPSS score1.11%
OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.CVE-2021-33492open-xchangeox_app_suiteEPSS score1.15%
OX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-33491open-xchangeox_app_suiteEPSS score2.52%
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.CVE-2021-33493open-xchangeox_app_suiteEPSS score0.49%
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.CVE-2021-33494open-xchangeox_app_suiteEPSS score1.15%
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-33495open-xchangeox_app_suiteEPSS score1.13%
OX App Suite 7.10.5 allows XSS via an OX Chat system message.CVE-2021-33490open-xchangeox_app_suiteEPSS score1.30%
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.CVE-2021-33488open-xchangeox_app_suiteEPSS score1.15%
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.CVE-2021-33489open-xchangeox_app_suiteEPSS score1.30%
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.CVE-2021-23929open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.CVE-2021-23927open-xchangeopen-xchange_appsuiteEPSS score0.77%
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.CVE-2021-23932open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.CVE-2021-23934open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.CVE-2021-23933open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.CVE-2021-23931open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via an inline binary file.CVE-2021-23936open-xchangeopen-xchange_appsuiteEPSS score0.93%
OX App Suite through 7.10.4 allows XSS via the subject of a task.CVE-2021-23935open-xchangeopen-xchange_appsuiteEPSS score1.09%
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.CVE-2021-23930open-xchangeopen-xchange_appsuiteEPSS score1.15%
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.