← Back

Open Xchange

open-xchange

272 CVEs • 14 products

Products (14)

Click to collapse
Toggle
Open Xchange Appsuite
open-xchange_appsuite
157 CVEs
Ox App Suite
ox_app_suite
48 CVEs
Dovecot
dovecot
16 CVEs
Open Xchange Appsuite Backend
open-xchange_appsuite_backend
14 CVEs
Open Xchange Server
open-xchange_server
13 CVEs
Ox Guard
ox_guard
11 CVEs
Open Xchange Appsuite Frontend
open-xchange_appsuite_frontend
8 CVEs
Open Xchange Appsuite Office
open-xchange_appsuite_office
4 CVEs
Open Xchange Documents
open-xchange_documents
3 CVEs
Open Xchange
open-xchange
2 CVEs
App Suite
app_suite
2 CVEs
Documentconverter Api
documentconverter-api
1 CVE
Office Web
office_web
1 CVE
Ox Cloud
ox_cloud
1 CVE

CVEs (272)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-8777
1Open Xchange
1Ox Cloud
Nov 21, 2024
May 22, 2019
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization.
CVE-2017-8341
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVE-2017-8340
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVE-2017-6912
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVE-2017-5864
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2017-5863
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVE-2017-9809
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 22, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.
CVE-2017-12884
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 10, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
CVE-2017-12885
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
May 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVE-2018-13104
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Mar 21, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)
CVE-2018-13103
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Mar 21, 2019
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
OX App Suite 7.8.4 and earlier allows SSRF.
CVE-2018-12611
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Jan 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite 7.8.4 and earlier allows Directory Traversal.
CVE-2018-12610
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Jan 30, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
OX App Suite 7.8.4 and earlier allows Information Exposure.
CVE-2018-12609
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Jan 30, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
CVE-2017-6913
1Open Xchange
1Open Xchange Appsuite
Nov 21, 2024
Sep 18, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag.
CVE-2018-9998
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 5, 2018
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitiv...Show more
Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.Show less
CVE-2018-9997
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jul 5, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject...Show more
Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.Show less
CVE-2018-5756
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jun 16, 2018
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allo...Show more
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.Show less
CVE-2018-5755
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jun 16, 2018
N/A· v4
5.5 MEDIUM· v3
7.1 HIGH· v2
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to...Show more
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.Show less
CVE-2018-5754
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jun 16, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafte...Show more
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.Show less