Open-Xchange Appsuite vulnerabilities

CVE-2017-17061 [MEDIUM] CWE-79 CVE-2017-17061: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).

CVE-2017-13668 [MEDIUM] CWE-79 CVE-2017-13668: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).

CVE-2020-12646 [MEDIUM] CWE-79 CVE-2020-12646: OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.

CVE-2022-29852 [MEDIUM] CWE-79 CVE-2022-29852: OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.

CVE-2017-15030 [MEDIUM] CWE-79 CVE-2017-15030: Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).

CVE-2017-5213 [MEDIUM] CWE-79 CVE-2017-5213: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).

CVE-2017-5864 [MEDIUM] CWE-79 CVE-2017-5864: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).

CVE-2020-15004 [MEDIUM] CWE-79 CVE-2020-15004: OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

CVE-2016-6848 [MEDIUM] CWE-254 CVE-2016-6848: An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead t

CVE-2023-29046 [MEDIUM] CWE-400 CVE-2023-29046: Connections to external data sources, like e-mail autoconfiguration, were not terminated in case the Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amoun

CVE-2022-29853 [MEDIUM] CWE-79 CVE-2022-29853: OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire M OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.

CVE-2013-5935 [MEDIUM] CVE-2013-5935: The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-r The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended location, a different vulnerability than CVE-2013-5200.

CVE-2013-6009 [MEDIUM] CWE-94 CVE-2013-6009: CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain condit CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet.

CVE-2020-12643 [MEDIUM] CWE-639 CVE-2020-12643: OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.

CVE-2013-2582 [MEDIUM] CWE-94 CVE-2013-2582: CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22 CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters.

CVE-2013-5035 [MEDIUM] CWE-362 CVE-2013-5035: Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before re Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations.

CVE-2014-9466 [MEDIUM] CWE-264 CVE-2014-9466: Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."

CVE-2016-4048 [MEDIUM] CVE-2016-4048: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be show An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks.

CVE-2014-2391 [MEDIUM] CWE-200 CVE-2014-2391: The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potentially useful password-pattern information by reading

CVE-2013-5936 [MEDIUM] CVE-2013-5936: The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-r The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call, a different vulne