← Back

Open Xchange

open-xchange

272 CVEs • 14 products

Products (14)

Click to collapse
Toggle
Open Xchange Appsuite
open-xchange_appsuite
157 CVEs
Ox App Suite
ox_app_suite
48 CVEs
Dovecot
dovecot
16 CVEs
Open Xchange Appsuite Backend
open-xchange_appsuite_backend
14 CVEs
Open Xchange Server
open-xchange_server
13 CVEs
Ox Guard
ox_guard
11 CVEs
Open Xchange Appsuite Frontend
open-xchange_appsuite_frontend
8 CVEs
Open Xchange Appsuite Office
open-xchange_appsuite_office
4 CVEs
Open Xchange Documents
open-xchange_documents
3 CVEs
Open Xchange
open-xchange
2 CVEs
App Suite
app_suite
2 CVEs
Documentconverter Api
documentconverter-api
1 CVE
Office Web
office_web
1 CVE
Ox Cloud
ox_cloud
1 CVE

CVEs (272)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-26699
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 22, 2021
N/A· v4
5.4 MEDIUM· v3
5.8 MEDIUM· v2
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.
CVE-2021-26698
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.
CVE-2020-28945
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
May 3, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constructor, in a Notes item.
CVE-2021-31935
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Apr 30, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view.
CVE-2021-31934
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Apr 30, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.
CVE-2020-28944
1Open Xchange
1Ox Guard
Jun 17, 2026
Apr 30, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.
CVE-2020-28943
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Apr 30, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
CVE-2021-23936
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via the subject of a task.
CVE-2021-23935
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.
CVE-2021-23934
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.
CVE-2021-23933
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.
CVE-2021-23932
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.
CVE-2021-23931
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via an inline binary file.
CVE-2021-23930
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.
CVE-2021-23929
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.
CVE-2021-23928
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.
CVE-2021-23927
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.4 MEDIUM· v3
5.5 MEDIUM· v2
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.
CVE-2020-24701
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
CVE-2020-24700
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 12, 2021
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.
CVE-2020-15004
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Oct 23, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.