| CVE-2025-59026 |
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links
|
5.4
Medium
|
Nov 27, 2025 |
| CVE-2025-59025 |
Malicious e-mail content can be used to execute script code
|
6.1
Medium
|
Nov 27, 2025 |
| CVE-2025-30190 |
Malicious content at office documents can be used to inject script code when editing a document
|
5.4
Medium
|
Nov 27, 2025 |
| CVE-2025-30186 |
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links
|
5.4
Medium
|
Nov 27, 2025 |
| CVE-2025-30191 |
Malicious content from E-Mail can be used to perform a redressing attack
|
5.4
Medium
|
Oct 31, 2025 |
| CVE-2025-30188 |
Malicious or unintentional API requests can be used to add significant amount of data to caches
|
7.5
High
|
Oct 31, 2025 |
| CVE-2024-25582 |
Module savepoints could be abused to inject references to malicious code delivered through the same domain
|
5.4
Medium
|
Aug 19, 2024 |
| CVE-2024-23188 |
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users…
|
6.5
Medium
|
May 6, 2024 |
| CVE-2024-23193 |
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user…
|
5.3
Medium
|
May 6, 2024 |
| CVE-2024-23187 |
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the…
|
6.5
Medium
|
May 6, 2024 |
| CVE-2024-23186 |
E-Mail containing malicious display-name information could trigger client-side script execution when using specific…
|
6.5
Medium
|
May 6, 2024 |
| CVE-2024-23192 |
RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session…
|
6.1
Medium
|
Apr 8, 2024 |
| CVE-2024-23191 |
Upsell advertisement information of an account can be manipulated to execute script code in the context of the users…
|
5.4
Medium
|
Apr 8, 2024 |
| CVE-2024-23190 |
Upsell shop information of an account can be manipulated to execute script code in the context of the users browser…
|
5.4
Medium
|
Apr 8, 2024 |
| CVE-2024-23189 |
Embedded content references at tasks could be used to temporarily execute script code in the context of the users…
|
5.4
Medium
|
Apr 8, 2024 |
| CVE-2023-41708 |
References to the "app loader" functionality could contain redirects to unexpected locations
|
5.4
Medium
|
Feb 12, 2024 |
| CVE-2023-41707 |
Processing of user-defined mail search expressions is not limited
|
6.5
Medium
|
Feb 12, 2024 |
| CVE-2023-41706 |
Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource…
|
6.5
Medium
|
Feb 12, 2024 |
| CVE-2023-41705 |
Processing of user-defined DAV user-agent strings is not limited
|
6.5
Medium
|
Feb 12, 2024 |
| CVE-2023-41704 |
Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine
|
7.1
High
|
Feb 12, 2024 |
| CVE-2023-41703 |
User ID references at mentions in document comments were not correctly sanitized
|
6.1
Medium
|
Feb 12, 2024 |
| CVE-2023-41710 |
User-defined script code could be stored for a upsell related shop URL
|
5.4
Medium
|
Jan 8, 2024 |
| CVE-2023-29052 |
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not…
|
5.4
Medium
|
Jan 8, 2024 |
| CVE-2023-29051 |
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API
|
8.1
High
|
Jan 8, 2024 |
| CVE-2023-29050 |
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to…
|
7.6
High
|
Jan 8, 2024 |