OX App Suite Server-Side Request Forgery Vulnerability (CNVD-2020-13202)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A server-side request forgery vulnerability exists in OX App Suite 7.10.2 and earlier versions. No detailed...

CVE-2019-18846

OX App Suite through 7.10.2 allows SSRF...

Open-Xchange App Suite / Documents Server-Side Request Forgery

Product: OX App Suite / OX Documents Vendor: OX Software GmbH Internal reference: 67871, 68258 Bug ID Vulnerability type: Server-Side Request Forgery CWE-918 Vulnerable version: 7.10.2 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed...

Open-Xchange: SSRF - Guard - Unchecked WKS servers

Note This is different vulnerability than HKP lookup 792953, although it does basically same thing and has same problem, these are independent implementations of key lookup and the vulnerable code isn't shared. Description When encrypting an email, one of strategies to lookup recipient's encrypti...

Open-Xchange: SSRF - Guard - Unchecked HKP servers

Description When encrypting an email, one of strategies to lookup recipient's encryption key is to contact a HKP keyserver specified in DNS records of recipient's domain. Specifically it is DNS SRV records for hkps.tcp. and hkp.tcp., which specify hostname and port of the keyserver. In source cod...

Open-Xchange: XSS - Guard - Insufficient escaping of User-IDs from PGP Keys

Vulnerability PGP user IDs are typically in form of name and OX Guard properly escapes angle brackets when inserting them to HTML. But in the code for displaying a list of keys it inserts IDs into HTML attributes without escaping double quote characters. javascript //...

CVE-2014-5236

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

Path traversal

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

CVE-2014-5236

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

CVE-2014-5236

CVE-2014-5236 affects Open-Xchange AppSuite, where the documentconverter component is vulnerable to absolute path traversal via crafted OLE Objects or images in OpenDocument text files. The impact is reading sensitive server files. Vendors provided fixes in versions: 7.4.2-rev10 and 7.6.0-rev10. ...

Open-Xchange OX App Suite Access Control Error Vulnerability (CNVD-2020-43160)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. An Access Control Error vulnerability exists in Open-Xchange App Suite 7.10.2 and prior versions. The vulnerability...

CVE-2014-5238

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

Xxe

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

CVE-2014-5238

CVE-2014-5238 concerns an XML external entity (XXE) vulnerability in Open-Xchange AppSuite. The OpenDocument Text handling allows expansion of XML entities (DTD recursive entities), enabling an attacker to read server files via a crafted document. The NVD entry notes the affected products as Open...

CVE-2014-5238

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-14085)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

OX App Suite Cross-Site Scripting Vulnerability (CNVD-2020-03028)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange App Suite 7.10.2 and prior versions. The vulnerability...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-13687)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

CVE-2013-7486

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...

CVE-2013-7485

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this...