CVE-2016-5124

Open-Xchange OX App Suite (frontend) is affected by CVE-2016-5124. Before 7.8.1-rev14, dragging and dropping images from external sources into HTML editors (e.g., E‑Mail Compose, OX Text) can inject script code in the user’s context, bypassing XSS filters. Exploitation requires user social engine...

CVE-2016-5124

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially...

CVE-2016-6848

CVE-2016-6848 affects Open-Xchange OX App Suite prior to 7.8.2-rev8. The issue allows via API requests to inject, generate and download executable files to the client using a Reflected File Download vector. A malicious platform-specific batch file can be created through a trusted domain without a...

CVE-2016-6852

Open-Xchange OX App Suite is affected by CVE-2016-6852. The vulnerability exists in versions prior to 7.8.2-rev8 and arises from allowing users to supply local file paths to the RSS reader. The response and error handling can reveal whether a given path exists, enabling attackers to enumerate spe...

CVE-2016-6853

Open-Xchange OX Guard (vulnerable: 2.4.2-rev5 and earlier) contains a cross-site scripting flaw where script code can be injected into PGP public key names. When a user later fetches the key via a specific URL, the injected script may execute in the user’s context, potentially leading to phishing...

CVE-2016-6845

The CVE-2016-6845 entry affects Open-Xchange OX App Suite prior to 7.8.2-rev8. The vulnerability arises from script code within hyperlinks in HTML emails not being properly sanitized when using base64 encoded data resources, allowing an attacker to supply hyperlinks that can execute script code i...

CVE-2016-2840

Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26 is affected. The issue arises from the session parameter on file-download requests, allowing injected script to be reflected on the subsequent status page and executed within a trusted domain’s context. Exploitation does not require authentic...

CVE-2015-8542

Open-Xchange Guard prior to 2.2.0-rev8 is affected. The getprivkeybyid API allows downloading a user’s PGP Private Key after authentication. The auth parameter contains a hashed password, used as a single point of authentication, and, because id and cid are sequential, an attacker can iterate the...

CVE-2016-4046

Open-Xchange OX App Suite (before 7.8.1-rev11) is affected by CVE-2016-4046. The API used to configure external mail accounts can be abused to map and access network components within the operator’s trust boundary; attackers can inject arbitrary hosts and ports into API calls, enabling informatio...

CVE-2016-3174

CVE-2016-3174 affects Open-Xchange OX AppSuite prior to 7.8.0-rev27. The issue lies in the defer servlet, which could redirect a client to a provided URL without sufficient checks, enabling phishing-oriented scenarios where users expect a trusted domain but land on an unintended service. Publicly...

CVE-2015-8542

An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID...

CVE-2016-6842

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...

CVE-2016-6851

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...

CVE-2016-6853

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

CVE-2016-6854

CVE-2016-6854 affects Open-Xchange OX Guard prior to 2.4.2-rev5. An injection flaw allows a script to run when verifying an inline PGP signature in a mail, enabling malicious code to execute in a user’s context and potentially hijack sessions or trigger actions via the web interface. Fixed in 2.4...

CVE-2016-4046

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response typ...

CVE-2016-4047

CVE-2016-4047 affects Open-Xchange OX App Suite prior to 7.8.1-rev8. The root cause is information disclosure through parsing of generated documents where references to external Open XML DTD resources can be embedded in .docx/.xlsx files; these resources are requested during parsing, enabling an ...

CVE-2016-4026

Open-Xchange OX App Suite (before 7.8.1-rev11) contains a vulnerability in the content sanitizer: when given invalid HTML, the filter may output an unsanitized representation, enabling malicious script execution in a user’s context and potential session hijacking or unintended actions via the web...

CVE-2016-4048

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected...

CVE-2016-4048

CVE-2016-4048 affects Open-Xchange OX App Suite before version 7.8.1-rev11. The login screen can display custom messages intended to inform external users about sharing-link issues, but this mechanism can be abused to inject arbitrary text, enabling social-engineering tricks that may mislead user...