← Back

Open Xchange

open-xchange

272 CVEs • 14 products

Products (14)

Click to collapse
Toggle
Open Xchange Appsuite
open-xchange_appsuite
157 CVEs
Ox App Suite
ox_app_suite
48 CVEs
Dovecot
dovecot
16 CVEs
Open Xchange Appsuite Backend
open-xchange_appsuite_backend
14 CVEs
Open Xchange Server
open-xchange_server
13 CVEs
Ox Guard
ox_guard
11 CVEs
Open Xchange Appsuite Frontend
open-xchange_appsuite_frontend
8 CVEs
Open Xchange Appsuite Office
open-xchange_appsuite_office
4 CVEs
Open Xchange Documents
open-xchange_documents
3 CVEs
Open Xchange
open-xchange
2 CVEs
App Suite
app_suite
2 CVEs
Documentconverter Api
documentconverter-api
1 CVE
Office Web
office_web
1 CVE
Ox Cloud
ox_cloud
1 CVE

CVEs (272)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-44209
1Open Xchange
1Ox App Suite
Jun 17, 2026
Mar 28, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
CVE-2021-44208
1Open Xchange
1Ox App Suite
Jun 17, 2026
Mar 28, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
CVE-2021-38378
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.
CVE-2021-38377
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results.
CVE-2021-38376
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
CVE-2021-38375
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
CVE-2021-38374
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.
CVE-2021-33495
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
CVE-2021-33494
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
CVE-2021-33493
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.0 MEDIUM· v3
3.6 LOW· v2
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
CVE-2021-33492
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
CVE-2021-33491
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses in conjunction with auto-configuration DNS records.
CVE-2021-33490
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
CVE-2021-33489
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
CVE-2021-33488
1Open Xchange
1Ox App Suite
Jun 17, 2026
Nov 22, 2021
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
CVE-2021-28095
1Open Xchange
1Open Xchange Documents
Jun 17, 2026
Jul 30, 2021
N/A· v4
4.8 MEDIUM· v3
5.8 MEDIUM· v2
OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32.
CVE-2021-28094
1Open Xchange
1Open Xchange Documents
Jun 17, 2026
Jul 30, 2021
N/A· v4
6.5 MEDIUM· v3
6.4 MEDIUM· v2
OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.
CVE-2021-28093
1Open Xchange
1Open Xchange Documents
Jun 17, 2026
Jul 30, 2021
N/A· v4
6.5 MEDIUM· v3
6.4 MEDIUM· v2
OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.
CVE-2021-37403
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.
CVE-2021-37402
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.