Open-Xchange GmbH OX App Suite

• CVE-2025-59026 Medium 5.4 Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfilt 0.2%
• CVE-2025-59025 Medium 6.1 Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has b 0.2%
• CVE-2025-30190 Medium 5.4 Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensi 0.2%
• CVE-2025-30186 Medium 5.4 Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfilt 0.2%
• CVE-2025-30191 Medium 5.4 Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable furthe 0.2%
• CVE-2025-30188 High 7.5 Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailabilit 0.4%
• CVE-2024-25582 Medium 5.4 Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account 0.4%
• CVE-2024-23193 Medium 5.3 E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case 0.5%
• CVE-2024-23188 Medium 6.5 Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to t 0.5%
• CVE-2024-23187 Medium 6.5 Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract infor 0.5%
• CVE-2024-23186 Medium 6.5 E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract informatio 0.6%
• CVE-2024-23192 Medium 6.1 RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accoun 0.5%
• CVE-2024-23191 Medium 5.4 Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a us 0.5%
• CVE-2024-23190 Medium 5.4 Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users accou 0.5%
• CVE-2024-23189 Medium 5.4 Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the use 0.5%
• CVE-2023-41708 Medium 5.4 References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Plea 0.5%
• CVE-2023-41707 Medium 6.5 Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Pro 0.8%
• CVE-2023-41706 Medium 6.5 Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high proc 0.8%
• CVE-2023-41705 Medium 6.5 Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Proc 0.8%
• CVE-2023-41704 High 7.1 Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting w 0.5%
• CVE-2023-41703 Medium 6.1 User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided up 0.5%
• CVE-2023-41710 Medium 5.4 User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script 0.4%
• CVE-2023-29052 Medium 5.4 Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious scrip 0.4%
• CVE-2023-29051 High 8.1 User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthor 0.5%
• CVE-2023-29050 High 7.6 The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break c 1.7%
• CVE-2023-29049 Medium 5.4 The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, 0.6%
• CVE-2023-29048 High 8.8 A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands wit 1.3%