Open-xchange Gmbh vulnerabilities
77 CVEs and advisories name Open-xchange Gmbh as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-27860If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.
- CVE-2026-27859A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.
- CVE-2026-27858Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
- CVE-2026-27857Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage.
- CVE-2026-27856Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack.
- CVE-2026-27855Dovecot OTP authentication is vulnerable to replay attack under specific conditions.
- CVE-2026-24031Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.
- CVE-2026-0394When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added
- CVE-2025-59032ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.
- CVE-2025-59031Dovecot has provided a script to use for attachment to text conversion.
- CVE-2025-59028When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai
- CVE-2025-59026Malicious content uploaded as file can be used to execute script code when following attacker-controlled links.
- CVE-2025-59025Malicious e-mail content can be used to execute script code.
- CVE-2025-30190Malicious content at office documents can be used to inject script code when editing a document.
- CVE-2025-30186Malicious content uploaded as file can be used to execute script code when following attacker-controlled links.
- CVE-2025-30189When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be us
- CVE-2025-30191Malicious content from E-Mail can be used to perform a redressing attack.
- CVE-2025-30188Malicious or unintentional API requests can be used to add significant amount of data to caches.
- CVE-2024-23185Very large headers can cause resource exhaustion when parsing message.
- CVE-2024-23184Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive.
- CVE-2024-25584Dovecot accepts dot LF DOT LF symbol as end of DATA command.
- CVE-2024-25582Module savepoints could be abused to inject references to malicious code delivered through the same domain.
- CVE-2024-23193E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.
- CVE-2024-23188Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session.
- CVE-2024-23187Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.
- CVE-2024-23186E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.
- CVE-2024-23192RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised
- CVE-2024-23191Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session.
- CVE-2024-23190Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session.
- CVE-2024-23189Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session.