Filtered by vendor Open-xchange Subscriptions
Total 262 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-30190 1 Open-xchange 1 Ox App Suite 2025-12-03 5.4 Medium
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
CVE-2025-59025 1 Open-xchange 1 Ox App Suite 2025-12-02 6.1 Medium
Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known
CVE-2025-59026 1 Open-xchange 1 Ox App Suite 2025-12-02 5.4 Medium
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
CVE-2025-30186 1 Open-xchange 1 Ox App Suite 2025-12-01 5.4 Medium
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
CVE-2025-30189 1 Open-xchange 1 Ox Dovecot Pro 2025-11-27 7.4 High
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
CVE-2023-41710 1 Open-xchange 1 Ox App Suite 2025-11-04 5.4 Medium
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
CVE-2023-41708 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 5.4 Medium
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
CVE-2023-41707 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 6.5 Medium
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
CVE-2023-41706 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 6.5 Medium
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
CVE-2023-41705 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 6.5 Medium
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
CVE-2023-41704 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 7.1 High
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
CVE-2023-41703 1 Open-xchange 1 Open-xchange Appsuite 2025-11-04 6.1 Medium
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
CVE-2023-29052 1 Open-xchange 1 Ox App Suite 2025-11-04 5.4 Medium
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
CVE-2023-29051 1 Open-xchange 1 Ox App Suite 2025-11-04 8.1 High
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.
CVE-2025-30191 1 Open-xchange 1 Ox App Suite 2025-11-04 5.4 Medium
Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known
CVE-2025-30188 1 Open-xchange 1 Ox App Suite 2025-11-04 7.5 High
Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available exploits are known
CVE-2023-29047 1 Open-xchange 1 Open-xchange Appsuite 2025-06-12 5.3 Medium
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.
CVE-2023-29048 1 Open-xchange 1 Ox App Suite 2025-06-06 8.8 High
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
CVE-2022-31468 1 Open-xchange 1 Ox App Suite 2025-05-09 6.1 Medium
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
CVE-2022-29851 1 Open-xchange 1 Ox App Suite 2025-05-07 9.8 Critical
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.