Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

203 results · page 1 of 5

Nov 27, 2025Malicious content uploaded as file can be used to execute script code when following attacker-controlled links.CVE-2025-59026 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Nov 27, 2025Malicious e-mail content can be used to execute script code.CVE-2025-59025 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Nov 27, 2025Malicious content at office documents can be used to inject script code when editing a document.CVE-2025-30190 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Nov 27, 2025Malicious content uploaded as file can be used to execute script code when following attacker-controlled links.CVE-2025-30186 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Oct 31, 2025Malicious content from E-Mail can be used to perform a redressing attack.CVE-2025-30191 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Oct 31, 2025Malicious or unintentional API requests can be used to add significant amount of data to caches.CVE-2025-30188 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.5
Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available exploits are known
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com
Aug 19, 2024Module savepoints could be abused to inject references to malicious code delivered through the same domain.CVE-2024-25582 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
May 6, 2024E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.CVE-2024-23193 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session.CVE-2024-23188 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.CVE-2024-23187 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
May 6, 2024E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.CVE-2024-23186 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org documentation.open-xchange.com
Apr 8, 2024RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successCVE-2024-23192 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session.CVE-2024-23191 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session.CVE-2024-23190 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Apr 8, 2024Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session.CVE-2024-23189 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering attack to make users import external content. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-generated content has been improved. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com documentation.open-xchange.com
Feb 12, 2024References to the "app loader" functionality could contain redirects to unexpected locations.CVE-2023-41708 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safeguards to inject malicious script code. Please deploy the provided updates and patch releases. References to apps are now controlled more strict to avoid relative references. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of user-defined mail search expressions is not limited.CVE-2023-41707 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.CVE-2023-41706 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing of user-defined drive search expressions is not limited No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of user-defined DAV user-agent strings is not limited.CVE-2023-41705 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.CVE-2023-41704 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.1
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be injected to a users sessions when interacting with E-Mails. Please deploy the provided updates and patch releases. CID handing has been improved and resulting content is checked for malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Feb 12, 2024User ID references at mentions in document comments were not correctly sanitized.CVE-2023-41703 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.1
User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avoid potentially malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024User-defined script code could be stored for a upsell related shop URL.CVE-2023-41710 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly.CVE-2023-29052 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API.CVE-2023-29051 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Jan 8, 2024The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hieCVE-2023-29050 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 7.6
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 8, 2024The "upsell" widget at the portal page could be abused to inject arbitrary script code.CVE-2023-29049 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jan 8, 2024A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user.CVE-2023-29048 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comHigh 8.8
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 2, 2023Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements.CVE-2023-29047 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.3
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged.CVE-2023-29046 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.CVE-2023-29045 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Documents operations could be manipulated to contain invalid data types, possibly script code.CVE-2023-29044 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a documeCVE-2023-29043 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 6.1
Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content. The relevant attribute does now get encoded to avoid the possibility of executing script code. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Users were able to set an arbitrary "product name" for OX Guard.CVE-2023-26456 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer.CVE-2023-26455 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.6
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked.CVE-2023-26454 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Requests to cache an image could be abused to include SQL queries that would be executed unchecked.CVE-2023-26453 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Nov 2, 2023Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked.CVE-2023-26452 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.open-xchange.com software.open-xchange.com
Aug 2, 2023Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.CVE-2023-26451 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.5
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The "OX Count" web service did not specify a media-type when processing responses by external resources.CVE-2023-26450 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The "OX Chat" web service did not specify a media-type when processing responses by external resources.CVE-2023-26449 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers.CVE-2023-26448 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The "upsell" widget for the portal allows to specify a product description.CVE-2023-26447 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.CVE-2023-26446 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the user-controllable clientID parameter. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login.CVE-2023-26445 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements.CVE-2023-26443 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.5
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.CVE-2023-26442 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.2
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources.CVE-2023-26441 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.7
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path validation and make sure that any access is contained to the defined root directory. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creatinCVE-2023-26440 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.1
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement.CVE-2023-26439 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have improved the input check for API calls and filter for potentially malicious content. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 2, 2023External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache.CVE-2023-26438 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.