Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Open-Xchange Open-Xchange AppSuiteInput Validation

Risk 86
Severity
9.8
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption.

First published (updated )
CVE-2020-12645

Open-Xchange Open-Xchange AppSuiteInput Validation

Risk 43
Severity
7.5
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OX App Suite through 7.10.3 has Improper Input Validation.

First published (updated )
CVE-2020-8543

Open-Xchange Open-Xchange AppSuiteSSRF

Risk 38
Severity
6.5
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OX App Suite through 7.10.3 allows SSRF.

First published (updated )
CVE-2020-8544

Open-Xchange Open-Xchange AppSuiteXEE

Risk 38
Severity
6.5
XEE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OX App Suite through 7.10.3 allows XXE attacks.

First published (updated )
CVE-2020-8541

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.

First published (updated )
CVE-2021-23930

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via an inline binary file.

First published (updated )
CVE-2021-23931

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=view URI.

First published (updated )
CVE-2021-23929

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.

First published (updated )
CVE-2021-23934

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.

First published (updated )
CVE-2021-23928

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.

First published (updated )
CVE-2021-23933

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.

First published (updated )
CVE-2021-23932

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.

First published (updated )
CVE-2021-23935

Open-Xchange Open-Xchange AppSuiteXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.

First published (updated )
CVE-2021-26698

Open-Xchange Open-Xchange AppSuiteSSRF

Risk 35
Severity
5.8
SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.

First published (updated )
CVE-2021-26699

Open-Xchange Open-Xchange AppSuiteSSRF

Risk 34
Severity
5.5
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.

First published (updated )
CVE-2020-24700

Open-Xchange Open-Xchange AppSuiteXSS

Risk 34
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.3 allows XSS.

First published (updated )
CVE-2020-8542

Open-Xchange Open-Xchange AppSuiteXSS

Risk 34
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.

First published (updated )
CVE-2020-12646

Open-Xchange Open-Xchange AppSuiteSSRF

Risk 26
Severity
5
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

First published (updated )
CVE-2020-15002

Open-Xchange Open-Xchange AppSuiteSSRF

Risk 26
Severity
5
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.

First published (updated )
CVE-2020-12644

Open-Xchange Open-Xchange AppSuiteXSS

Risk 29
Severity
4.8
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

First published (updated )
CVE-2020-15004

Open-Xchange Open-Xchange AppSuiteOX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and…

Risk 22
Severity
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive access).

First published (updated )
CVE-2020-15003

Open-Xchange Open-Xchange AppSuiteOX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a…

Risk 22
Severity
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.

First published (updated )
CVE-2020-12643

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203