Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 304

Export CSV
CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-9997

Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5756

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.

CVSS 3.0 · 4.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5755

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.

CVSS 3.0 · 5.5 Medium EPSS 7.7% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5754

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.

CVSS 3.0 · 5.4 Medium EPSS 2.9% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5753

The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.

CVSS 3.0 · 6.5 Medium EPSS 8.1% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5752

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.

CVSS 3.0 · 8.8 High EPSS 4.5% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2018-5751

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.

CVSS 3.0 · 6.5 Medium EPSS 8.9% KEV · Not listed
Vendors
Open-xchange
Products
Open-xchange Appsuite
CVE-2017-8777

Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization.

CVSS 3.0 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Open-xchange
Products
Ox Cloud