Path traversal

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

PT-2020-7710

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.4.2-rev10 Open-Xchange OX AppSuite versions 7.6.x prior to 7.6.0-rev10 Description The issue allows remote attackers to read application files via a full pathname in a crafted OLE Object or image in...

CVE-2014-5236: Improper Limitation of a Pathname to a Restricted Directory

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

CVE-2014-5238: Improper Restriction of XML External Entity Reference

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

PT-2020-7711

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.4.2-rev11 Open-Xchange OX AppSuite versions 7.6.x prior to 7.6.0-rev9 Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impacts via a crafted...

CVE-2013-7486

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...

CVE-2013-7486: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...

CVE-2013-6242: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and th...

CVE-2013-7485: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this...

PT-2020-7581

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.2.x through 7.2.2-rev25 Open-Xchange OX AppSuite versions 7.4.x through 7.4.0-rev15 Description A cross-site scripting XSS issue exists in the backend of Open-Xchange OX AppSuite, allowing remote attackers t...

PT-2020-7542

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX AppSuite versions 6.22.3 through 6.22.3-rev4 Open-Xchange OX AppSuite versions 6.22.4 through 6.22.4-rev11 Description: A cross-site scripting XSS issue exists in the frontend of Open-Xchange OX AppSuite, allowing remote...

PT-2020-7582

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.2.x through 7.2.2-rev26 Open-Xchange OX AppSuite versions 7.4.x through 7.4.0-rev19 Description A cross-site scripting XSS issue exists in the backend of Open-Xchange OX AppSuite, allowing remote attackers t...

PT-2018-4191

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite version 7.4.2 Description The issue allows remote attackers to obtain sensitive information about user email addresses under certain circumstances. This is due to a failure in email auto configuration for external...

CVE-2014-2078: Exposure of Sensitive Information to an Unauthorized Actor

The backend in Open-Xchange OX AppSuite 7.4.2 before 7.4.2-rev9 allows remote attackers to obtain sensitive information about user email addresses in opportunistic circumstances by leveraging a failure in e-mail auto configuration for external accounts...

CVE-2016-6846: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, a...

CVE-2016-3174

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

Open redirect

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...