CVE-2017-5863

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control...

CVE-2017-8340

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control...

CVE-2017-8341

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing...

CVE-2017-8777

Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization...

CVE-2017-5863

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control...

CVE-2017-5863

Open-Xchange OX App Suite ≤ 7.8.3 is affected by Incorrect Access Control. The issue allows resources to be accessed by unauthorized roles, potentially impacting website access and overall security (per CNVD/NVD entries referencing this CVE and Open-Xchange context). The NVD metrics indicate Conf...

CVE-2017-5864

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting XSS...

CVE-2017-5864

Open-Xchange OX App Suite 7.8.3 and earlier is affected by Cross Site Scripting (XSS) due to insufficient validation of client data in the web application. The CVEs (CVE-2017-5864) and multiple entries confirm this XSS impact; no explicit patch version or remediation details are provided in the c...

CVE-2017-6912

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control...

CVE-2017-6912

Open-Xchange OX App Suite 7.8.3 and earlier are affected by Incorrect Access Control. This is confirmed across multiple sources (NVD entry and Red Hat/CNVD variants). The documents do not provide a detailed root cause, impacted components beyond the OX App Suite itself, or a concrete remediation/...

CVE-2017-8340

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control...

CVE-2017-8340

CVE-2017-8340 affects Open-Xchange OX App Suite up to version 7.8.3. The issue is described as Incorrect Access Control, with multiple sources noting an access-control error that could enable unauthorized access to resources and, per CNVD/Red Hat context, potentially web administrator access. Det...

CVE-2017-8341

Open-Xchange OX App Suite 7.8.3 and earlier is affected by Content Spoofing. The sources identify the affected product/version but do not provide the root cause, exploit method, or explicit impact beyond spoofing. No remediation details are present in the documents; monitor for updates from Red H...

CVE-2017-8341

Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing...

CVE-2017-8777

Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization...

CVE-2017-8777

CVE-2017-8777 affects Open-Xchange GmbH OX Cloud Plugins (versions 1.4.0 and earlier). The root cause is Missing Authorization, as described across multiple feeds (NVD/Red Hat/CVE). The connected documents do not provide explicit exploitation details or a confirmed remediation version in the supp...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in OX Software GmbH App Suite 7.8.4 and earlier versions. The...

Open-Xchange: Two heap use-after-free errors in IMAP operations

Summary ======= We’ve found two heap use-after-free errors, one in lib-storage/index/index-storage.c: indexcopycachefields and one in lib-index/mail-index-sync-update.c: mailindexsyncrecordreal. Error 1: indexcopycachefields ---------------------------------------------- This error involves two...

Open-Xchange: Another Stored XSS in mail app using Drive app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...

Open-Xchange: Stored XSS in mail app

Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...