OX App Suite up to and including 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
open-xchange ox app suite