CVE-2013-5936

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about 1 runtime activity, 2 network configuration, 3 user sessions, 4 the memcache interface, and 5 the REST interface via API calls suc...

CVE-2013-5200

Open-Xchange AppSuite 7.0.x (before 7.0.2-rev15) and 7.2.x (before 7.2.2-rev16) exposes the Hazelcast cluster API REST and memcache interfaces without authentication. This allows remote attackers to obtain sensitive information or modify data via API calls. Root cause is insecure/default configur...

CVE-2013-5935

Open-Xchange AppSuite (Hazelcast cluster API) is affected in 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16. The root cause is that the Hazelcast-based cluster API does not properly restrict the network interfaces that can receive API calls, and REST/memcache interfaces do not require auth...

CVE-2013-5936

Open-Xchange AppSuite vulnerability CVE-2013-5936 affects 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16. The Hazelcast cluster API exposes REST and memcache interfaces without authentication, enabling an attacker to obtain sensitive information (runtime activity, network configuration, us...

CVE-2013-5935

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended...

CVE-2013-5934

Open-Xchange AppSuite suffers CVE-2013-5934: the Hazelcast cluster API on Open-Xchange AppSuite 7.0.x (before 7.0.2-rev15) and 7.2.x (before 7.2.2-rev16) contains a hardcoded password used for node joining. This enables remote attackers to expand the cluster by locating the password in the source...

Open-Xchange AppSuite 7.2.2 Improper Authentication / Information Disclosure

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 28260 Bug ID Vulnerability type: CWE-16: Configuration, CWE-287: Improper Authentication, CWE-200: Information Exposure Vulnerable version: 7.0.0 to 7.2.2 Vulnerable component: backend default configuration Fixed version...

CVE-2013-4790

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-3106

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

CVE-2013-5698

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, ...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, ...

CVE-2013-4790

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

Race condition

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

Crlf injection

CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitizatio...

CVE-2013-5035

Vulnerability: Race conditions in HtmlCleaner (library used by Open-Xchange AppSuite) allow remote authenticated users to read other users’ private emails when rapid mail-send or draft-save operations occur. Affected versions: HtmlCleaner prior to 2.6; Open-Xchange AppSuite 7.2.2 before rev13 (an...

CVE-2013-3106

CVE-2013-3106 describes multiple XSS vulnerabilities in Open-Xchange AppSuite and Server across several versions: before 6.20.7 rev18, 6.22.0 rev16, 6.22.1 rev19, 7.0.1 rev7, 7.0.2 rev11, and 7.2.0 rev8. The confirmed vectors include (1) embedded VBScript, (2) object/data Base64 content, (3) Cont...

CVE-2013-4790

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-5698

CVE-2013-5698 is an XSS vulnerability in Open-Xchange AppSuite and Server. The flaw affects the product versions listed in the description: Open-Xchange AppSuite/Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8, where a crafted delivery...

CVE-2013-4790

Open-Xchange AppSuite is affected by CVE-2013-4790. Versions prior to 7.0.2 rev14, 7.2.0 rev11, 7.2.1 rev10, and 7.2.2 rev9 rely on user-supplied data to predict the IMAP server hostname for an external domain, enabling remote authenticated users to discover other users’ email credentials through...

CVE-2013-2582

CVE-2013-2582 affects Open-Xchange Server 6 / OX AppSuite. The vulnerability is a CRLF injection in the redirect servlet caused by insufficient whitespace sanitization, enabling attackers to inject HTTP headers and perform open redirects. Affected fixed versions per vendor advisory: 6.22.0-rev15,...