Race condition

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via 1 invalid JSON data in a mail-sending POST request, 2 an arbitrary parameter to...

Open redirect

OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate...

Directory traversal

Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. dot dot in the publication template path...

Open redirect

Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Open redirect

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

CVE-2013-1649

Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2013-3106

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

CVE-2013-1646

CVE-2013-1646 covers multiple cross-site scripting vulnerabilities in Open-Xchange Server 6. The affected product is Open-Xchange Server 6 (Open-Xchange GmbH). Vulnerabilities exist in various vectors including invalid JSON in mail requests, TestServlet parameters, javascript: URLs in standalone ...

CVE-2013-1650

CVE-2013-1650 concerns Open-Xchange Server: before 6.20.7-rev14, 6.22.0-before rev13, and 6.22.1-before rev14, weak permissions (group "other" readable) under opt/open-xchange/etc/ allow local users to obtain sensitive information via standard filesystem operations. The issue is a local disclosur...

CVE-2013-1646

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via 1 invalid JSON data in a mail-sending POST request, 2 an arbitrary parameter to...

CVE-2013-1645

CVE-2013-1645 concerns Open-Xchange Server 6. A directory traversal flaw allows remote authenticated users to read arbitrary files via a malformed publication template path (..). Affected releases include 6.20.7-rev14, 6.22.0-rev13, and 6.22.1-rev13 (and earlier). The published fix versions are 6...

CVE-2013-5035

Vulnerability: Race conditions in HtmlCleaner (library used by Open-Xchange AppSuite) allow remote authenticated users to read other users’ private emails when rapid mail-send or draft-save operations occur. Affected versions: HtmlCleaner prior to 2.6; Open-Xchange AppSuite 7.2.2 before rev13 (an...

CVE-2013-5698

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, ...

CVE-2013-2583

CVE-2013-2583 covers multiple XSS vulnerabilities affecting Open-Xchange Server 6 and OX AppSuite. The issues allow remote attackers to inject arbitrary web script or HTML through vectors including (1) javascript: URLs, (2) malformed nested SCRIPT elements, (3) HTML in mail signatures, or (4) Jav...

CVE-2013-2583

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL, 2 malformed nested...

CVE-2013-3106

CVE-2013-3106 describes multiple XSS vulnerabilities in Open-Xchange AppSuite and Server across several versions: before 6.20.7 rev18, 6.22.0 rev16, 6.22.1 rev19, 7.0.1 rev7, 7.0.2 rev11, and 7.2.0 rev8. The confirmed vectors include (1) embedded VBScript, (2) object/data Base64 content, (3) Cont...

CVE-2013-1651

CVE-2013-1651 describes OXUpdater in Open-Xchange Server failing to verify SSL certificates from update servers, enabling MITM spoofing and deployment of arbitrary software via crafted certificates. Affected products/versions are Open-Xchange Server 6: before 6.20.7-rev14, 6.22.0-before-rev13, an...

CVE-2013-1651

OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate...