CVE-2013-5698

CVE-2013-5698 is an XSS vulnerability in Open-Xchange AppSuite and Server. The flaw affects the product versions listed in the description: Open-Xchange AppSuite/Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8, where a crafted delivery...

CVE-2013-2582

CVE-2013-2582 affects Open-Xchange Server 6 / OX AppSuite. The vulnerability is a CRLF injection in the redirect servlet caused by insufficient whitespace sanitization, enabling attackers to inject HTTP headers and perform open redirects. Affected fixed versions per vendor advisory: 6.22.0-rev15,...

CVE-2013-4790

Open-Xchange AppSuite is affected by CVE-2013-4790. Versions prior to 7.0.2 rev14, 7.2.0 rev11, 7.2.1 rev10, and 7.2.2 rev9 rely on user-supplied data to predict the IMAP server hostname for an external domain, enabling remote authenticated users to discover other users’ email credentials through...

CVE-2013-2583: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL, 2 malformed nested...

CVE-2013-5035: Concurrent Execution using Shared Resource with Improper Synchronization

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

CVE-2013-2582: Improper Control of Generation of Code

CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitizatio...

CVE-2013-3106: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

CVE-2013-4790: Undefined Security Weakness

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-5698: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, ...

Open-Xchange Security Advisory 2013-06-03

Open-Xchange Security Advisory multiple vulnerabilities Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. The vendor has chosen a responsible full disclosure method to publish security issue details. Users of the software have already been provided...