Vendor
Open-Xchange
77 known vulnerabilities.
77 results · Feed
-
Medium 4.3
Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachme…
-
Medium 6.1
Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the u…
-
Medium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Uninten…
-
Medium 5.4
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can…
-
Medium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Uninten…
-
High 7.4
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached…
-
Medium 5.4
Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended ac…
-
High 7.5
Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict infor…
-
High 7.5
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably siz…
-
Medium 5.0
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header …
-
Medium 5.3
Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. Thi…
-
Medium 5.4
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers c…
-
Medium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user …
-
Medium 6.5
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the user…
-
Medium 6.5
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "s…
-
Medium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mob…
-
Medium 6.1
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when…
-
Medium 5.4
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser ses…
-
Medium 5.4
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users br…
-
Medium 5.4
Embedded content references at tasks could be used to temporarily execute script code in the context of the users brows…
-
Medium 5.4
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app…
-
Medium 6.5
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to…
-
Medium 6.5
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource thr…
-
Medium 6.5
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to …
-
High 7.1
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engin…
-
Medium 6.1
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a us…
-
Medium 5.4
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when addi…
-
Medium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not saniti…
-
High 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing …
-
High 7.6
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to a…
-
Medium 5.4
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure u…
-
High 8.8
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as t…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a r…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 5.9
An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a …
-
Medium 5.3
An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated att…