Open-Xchange: Selecting encryption for email with drive attachment overrides the drive email password

If you start composing a new email to an external email, otherwise decryption fails, attach a document, then click "Use drive mail", and set a password. Then click "Security" then encrypt not by clicking the lock icon, as that will show the warning and disable drive mail attachments. When you sen...

Open-Xchange: Stored XSS in Template Documents

Steps to reproduce: Setup: Edit My Contact Data: - first name: ' onmouseover=alert1 data-first=' - last name: anything 1. Create a new text document, and make sure it is saved. 2. Click Review, check "Track Changes". 3. Make another edit, it should show coloured now as it is tracked. 4. Click Fil...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09993)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09992)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09990)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09994)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09989)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09991)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Open-Xchange AppSuite Information Disclosure Vulnerability (CNVD-2016-09926)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. An information disclosure vulnerability exists in Open-Xchange AppSuite 7.8.2 and...

Open-Xchange AppSuite Local Code Execution Vulnerability

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A local code execution vulnerability exists in Open-Xchange AppSuite, which can be...

Multiple Content Spoofing Vulnerabilities in Open-Xchange AppSuite

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. Open-Xchange AppSuite suffers from multiple content spoofing vulnerabilities that c...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability (CNVD-2016-07643)

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A cross-site scripting vulnerability exists in Open-Xchange OX Guard 2.4.2 and prior versions, which stems from the program's failure to adequately filter user-submitted input. When a user...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability (CNVD-2016-07642)

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A cross-site scripting vulnerability exists in Open-Xchange OX Guard 2.4.2 and prior versions, which stems from the program's failure to adequately filter user-submitted input. When a user...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-07644)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in OX AppSuite that stems from the...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability (CNVD-2016-07641)

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A cross-site scripting vulnerability exists in Open-Xchange OX Guard 2.4.2 and prior versions, which stems from the program not adequately filtering user-submitted input. When a user brows...

Open-Xchange App Suite 7.8.2 - Cross-Site Scripting

Open-Xchange App Suite 7.8.2 - Cross-Site Scripting Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status:...

Open-Xchange App Suite 7.8.2 - Cross-Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Open-Xchange Guard 2.4.2 - Multiple Cross Site Scripting

Exploit for linux platform in category web applications Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed...

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities

Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.4.0-rev11, 2.4.2-rev5...

Open-Xchange: OX Guard: DOM Based Cross-Site Scripting (#2)

Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. While this report is closely related to 158853, it is not a duplicate. I've had a look at the code introduced by commit 7fdbd307662f0041ed5e45b2f73c6530b79c6124, which I believe was supposed to protect against 158853. Today's repor...