Total 254 security vulnerabilities recorded for open-xchange software and firmware.
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file....
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook....
OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use o...
OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32....
OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32....
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created ...
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint h...
OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component...
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created ...
OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  that is mishandled in the scheduling view....
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite...
OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data....
OX App Suite 7.10.4 and earlier allows SSRF via a snippet....
OX App Suite through 7.10.4 allows XSS via the subject of a task....
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code....
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code....
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL....
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename....
OX App Suite through 7.10.4 allows XSS via an inline binary file....
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile....
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?delivery=v...
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string....
OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request....