Lucene search
CVE-2018-9997
CVE-2018-9997 Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page with data-toggle gadgets
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | CVE-2018-9997 | 5 Jul 201820:29 | – | nvd |
 | Cross site scripting | 5 Jul 201820:29 | – | prion |
 | CVE-2018-9997 | 5 Jul 201820:00 | – | cvelist |
 | Open-Xchange (OX) App Suite Multiple Vulnerabilities (Jul 2018) | 3 Jul 201800:00 | – | openvas |
 | OX App Suite 7.8.4 XSS / XML Injection / Information Disclosure Vulnerabilities | 3 Jul 201800:00 | – | zdt |
 | OX App Suite 7.8.4 XSS / XML Injection / Information Disclosure | 2 Jul 201800:00 | – | packetstorm |
| Open-Xchange OX Guard Cross Site Scripting / Signature Validation | 16 Aug 201900:00 | – | packetstorm |
Node
OROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROROR
| Source | Link |
|---|---|
| packetstormsecurity | www.packetstormsecurity.com/files/154127/Open-Xchange-OX-Guard-Cross-Site-Scripting-Signature-Validation.html |
| seclists | www.seclists.org/fulldisclosure/2018/Jul/12 |
| securitytracker | www.securitytracker.com/id/1041213 |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| action | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| timezone | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| folder | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| columns | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| sort | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| order | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| cache | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| session | query param | /appsuite/api/tasks | Information exposure through error messages that disclose folder names to unauthorized users. | CWE-200 |
| data-target | request body | /mail/compose | XSS vulnerability allowing execution of scripts in user's context via malicious data-target attributes. | CWE-80 |
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo05 Jul 2018 20:29Current
6Medium risk
Vulners AI Score6
CVSS24.3
CVSS36.1
EPSS0.00338