Total 254 security vulnerabilities recorded for open-xchange software and firmware.
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerabil...
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes w...
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within ...
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within t...
Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can b...
The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped ...
The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the...
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious s...
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abuse...
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with a...
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker wit...
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed wh...
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement....
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Atta...
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extens...
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserializat...
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discov...
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue ...
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue ...
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue ...
IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts coul...
Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and p...
Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other user...
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default...