CVE-2023-26435

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limite...

CVE-2023-26435

Open-Xchange App Suite vulnerability (CVE-2023-26435) arises from a code issue related to processing ODT documents via a local LibreOffice instance. The root cause is insufficient validation of filesystem and network references, enabling an attacker to discover restricted network topology and ser...

Open-Xchange AppSuite 代码问题漏洞

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A code issue vulnerability exists in Open-Xchange App Suite that stems from the ability to inject serialized Java objects,...

Open-Xchange OX App Suite 命令注入漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite OXAS-BACKEND, which stems from the failure to remove control characters when exporting user feedback content, allowing an attacker t...

Open-Xchange OX App Suite 代码问题漏洞

Open-Xchange OX App Suite is an e-mail and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite that stems from an IPv4-mapped IPv6 address not being recognized by code as a local address, which can be exploited by an attacker ...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is an e-mail and productivity suite client software from German company Open-Xchange. A security vulnerability exists in OX App Suite that stems from overly lax default permissions on file attributes, which allows local system users to read potentially sensitive...

Open-Xchange App Suite 代码问题漏洞

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A code issue vulnerability exists in Open-Xchange App Suite that stems from the ability to call file system and network...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite OXAS-BACKEND, which stems from the SMTP function response processing not limiting the size of the response to a reasonable size when...

Open-Xchange App Suite 安全漏洞

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A security vulnerability exists in Open-Xchange App Suite that stems from the processing of POP3 function responses withou...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite OXAS-BACKEND, which stems from the fact that an attacker can successfully request arbitrary fragment IDs, including email signatures...

PT-2023-3428 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite affected versions not specified Description: The issue is related to the processing of POP3 "capabilities" responses, which are not limited to plausible sizes. An attacker with access to a rogue POP3 service could trigger request...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite OXAS-BACKEND, which stems from the IMAP function response processing not limiting the size of the response to a reasonable size when...

CVE-2023-24605

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

PT-2023-19700 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue is related to an information leak in the handling of distribution lists. This leak can result in the partial disclosure of private contacts of another user. Recommendations: F...

PT-2023-19701 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, also referred to as "ID confusion." Recommendations: For versions prior to...

PT-2023-19705 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue concerns a lack of size limit checks when downloading data, potentially allowing a crafted iCal feed to provide an unlimited amount of data. This could be exploited, for...

PT-2023-19706 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev37 Description: The issue concerns the lack of HTTP header length checks when downloading data, such as iCal feeds. This could potentially allow a crafted feed to provide an excessive amount of header...

PT-2023-19699 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows the loading of an e-mail message's remote resources during printing without user consent. Recommendations: For versions prior to 7.10.6-rev24, update to version...

Open-Xchange OX App Suite 跨站脚本漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite version 7.10.6-rev23. An attacker could exploit the vulnerability to view user privacy...