Filtered by vendor Open-xchange
Subscriptions
Filtered by product Open-xchange Appsuite
Subscriptions
Total
151 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2013-2583 | 1 Open-xchange | 2 Open-xchange Appsuite, Open-xchange Server | 2022-10-03 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL, (2) malformed nested SCRIPT elements, (3) a mail signature, or (4) JavaScript code within an image file. | ||||
| CVE-2013-4790 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in opportunistic circumstances via a manual-mode association of a personal e-mail address with the hostname of a crafted IMAP server. | ||||
| CVE-2013-5935 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended location, a different vulnerability than CVE-2013-5200. | ||||
| CVE-2013-5690 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment. | ||||
| CVE-2013-5934 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different vulnerability than CVE-2013-5200. | ||||
| CVE-2013-5035 | 2 Htmlcleaner Project, Open-xchange | 2 Htmlcleaner, Open-xchange Appsuite | 2022-10-03 | N/A |
| Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations. | ||||
| CVE-2013-5200 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call. | ||||
| CVE-2013-5936 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call, a different vulnerability than CVE-2013-5200. | ||||
| CVE-2013-5698 | 1 Open-xchange | 2 Open-xchange Appsuite, Open-xchange Server | 2022-10-03 | N/A |
| Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, a different vulnerability than CVE-2013-3106. | ||||
| CVE-2013-6009 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-10-03 | N/A |
| CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet. | ||||
| CVE-2013-3106 | 1 Open-xchange | 2 Open-xchange Appsuite, Open-xchange Server | 2022-10-03 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via (1) embedded VBScript, (2) object/data Base64 content, (3) a Content-Type header, or (4) UTF-16 encoding, aka Bug IDs 25957, 26237, 26243, and 26244. | ||||
| CVE-2020-8542 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-04-08 | 5.4 Medium |
| OX App Suite through 7.10.3 allows XSS. | ||||
| CVE-2021-37403 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-02-24 | 6.1 Medium |
| OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used. | ||||
| CVE-2021-37402 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-02-10 | 6.1 Medium |
| OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled. | ||||
| CVE-2021-26699 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-02-10 | 5.4 Medium |
| OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used. | ||||
| CVE-2021-26698 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-02-10 | 6.1 Medium |
| OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used. | ||||
| CVE-2019-18846 | 1 Open-xchange | 1 Open-xchange Appsuite | 2022-01-01 | 5.0 Medium |
| OX App Suite through 7.10.2 allows SSRF. | ||||
| CVE-2020-24701 | 1 Open-xchange | 1 Open-xchange Appsuite | 2021-09-14 | 6.1 Medium |
| OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). | ||||
| CVE-2020-24700 | 1 Open-xchange | 1 Open-xchange Appsuite | 2021-09-14 | 5.4 Medium |
| OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. | ||||
| CVE-2020-15003 | 1 Open-xchange | 1 Open-xchange Appsuite | 2021-07-21 | 4.3 Medium |
| OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access). | ||||