32 matches found
EUVD-2016-7736
Malware in sbrugna...
CVE-2016-6853
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...
CVE-2016-6851
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...
CVE-2016-4028
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...
CVE-2016-4028
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...
Design/Logic Flaw
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...
Design/Logic Flaw
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...
Cross site scripting
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...
Open redirect
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...
CVE-2016-4028
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...
CVE-2016-6854
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...
CVE-2016-6853
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...
CVE-2016-6851
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...
CVE-2016-6853: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...
CVE-2016-6854: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...
PT-2016-7144
Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue allows script code and references to external websites to be injected into the names of PGP public keys. When a user requests the key later using a specific URL, the...
PT-2016-5813
Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.0-rev8 Description An issue in Open-Xchange OX Guard allows attackers to guess the correct padding of the authentication token by exploiting the API's behavior as a padding oracle. This is possible d...
CVE-2016-4028: Undefined Security Weakness
An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...
PT-2016-7142
Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue in Open-Xchange OX Guard allows script code to be provided as a parameter to the OX Guard guest reader web application, enabling cross-site scripting attacks against...
PT-2016-7145
Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue in Open-Xchange OX Guard allows script code injected into a mail with an inline PGP signature to be executed when the signature is verified. This can lead to malicious...