Vulnerabilities > Open Xchange > OX APP Suite > 8.16
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-05-06 | CVE-2024-23186 | Cross-site Scripting vulnerability in Open-Xchange OX APP Suite E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. | 6.1 |
| 2024-05-06 | CVE-2024-23187 | Cross-site Scripting vulnerability in Open-Xchange OX APP Suite Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. | 6.1 |
| 2024-05-06 | CVE-2024-23193 | Session Fixation vulnerability in Open-Xchange OX APP Suite E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. | 5.3 |
| 2024-01-08 | CVE-2023-29050 | Injection vulnerability in Open-Xchange OX APP Suite 7.10.5/7.10.6/8.16 The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. | 9.6 |