The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.

OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)

OX App Suite 7.8.4 and earlier allows SSRF.

OX App Suite 7.8.4 and earlier allows Directory Traversal.

OX App Suite 7.8.4 and earlier allows Information Exposure.

OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.

OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.

OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.

Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).

Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.