Open-Xchange Server 6 - Multiple Vulnerabilities

Multiple security issues for Open-Xchange Server have been discovered and fixed. The vendor has chosen responsible full disclosure to publish security issue details. Users of the software have already been provided with patched versions. Proof regarding authenticity can be obtained from the...

Open-Xchange 6 XSS / LFI / SSRF / Hashing

Multiple security issues for Open-Xchange Server have been discovered and fixed. The vendor has chosen responsible full disclosure to publish security issue details. Users of the software have already been provided with patched versions. Proof regarding authenticity can be obtained from the...

Default credentials

The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed...

CVE-2006-2738

The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed...

CVE-2006-2738

The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed...

CVE-2006-2738

The CVE-2006-2738 entry concerns the open source Open-Xchange 0.8.2 and earlier. It states that a static default username and password, with a valid login shell in the ldap-server initfile, enables remote attackers to access any server where the default has not been changed. Affected component: t...

Wavecon Advisory: Open-Xchange <= 0.8.2 defaultuser with /bin/bash and default password

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory Name Open-Xchange defaultuser with /bin/bash Vendor Open-Xchange Inc. Product Open-Xchange Version 0.8.2 Author Cemil Degirmenci Risk high o Description: ======================= The OPEN-XCHANGE Collaboration and Integration Server Environmen...

Cross site scripting

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

CVE-2006-0091

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

CVE-2006-0091

CVE-2006-0091 affects Open-Xchange Webmail prior to/including 0.8.1-6 with Inline HTML enabled. The vulnerability is a Cross-Site Scripting (XSS) flaw that lets an attacker inject arbitrary web script or HTML via e-mail attachments, which are rendered inline by the webmail interface. The referenc...

CVE-2006-0091

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

[Full-disclosure] Open Xchange XSS

Open Xchange webmail =0.8.1-6 suffers from xss. http://mirror.open-xchange.org/ox/EN/community/ Vendor response: For the commercial OX you don't need this as there exists additional security options where you will not able to use this session. It's a general problem for all web based mailers and...