CVE-2018-5751

CVE-2018-5751 concerns the Open-Xchange OX App Suite backend component. The vulnerability, present in versions listed as vulnerable (before 7.6.3-rev36; 7.8.x before 7.8.2-rev39; 7.8.3 before 7.8.3-rev44; and 7.8.4 before 7.8.4-rev22), allows remote authenticated users to obtain sensitive informa...

CVE-2017-17062

CVE-2017-17062 affects the backend component of Open-Xchange OX App Suite. Remote authenticated users could save arbitrary user attributes due to improper privilege management. Affected versions include Open-Xchange App Suite 7.6.3-rev35 and earlier in 7.6.x, 7.8.x before 7.8.2-rev38, 7.8.3 befor...

CVE-2018-5755

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet...

CVE-2018-5755: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet...

CVE-2018-5756: Improper Privilege Management

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

PT-2018-17125

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22...

PT-2018-17124

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22...

PT-2018-17127

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.8.3-rev12 Open-Xchange OX App Suite versions prior to 7.8.4-rev9 Description: A cross-site scripting XSS issue exists in the office-web component, allowing remote attackers to inject arbitrary web...

CVE-2017-17062: Improper Neutralization of Input During Web Page Generation

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management...

PT-2018-6387

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev35 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev38 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev41 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev19...

PT-2018-17129

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22...

PT-2018-17126

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev31 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev31 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev41 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev20...

CVE-2018-5751: Exposure of Sensitive Information to an Unauthorized Actor

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs...

CVE-2018-5752: Server-Side Request Forgery (SSRF)

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors involving non-decimal representations of IP addresses and...

CVE-2018-5754: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard...

CVE-2018-5753: Improper Input Validation

The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a 1 From or 2 Sender address...

PT-2018-17128

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev3 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev4 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev5 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev4...

OX App Suite Cross-Site Scripting Vulnerability

OX App Suite is a collection of cloud-based applications that support the management of email, contacts, calendars, media, documents and more. A cross-site scripting vulnerability exists in OX App Suite, which can be exploited by an attacker to execute malicious code in the user context...

OX App Suite Server-Side Request Forgery Vulnerability

OX App Suite is a collection of cloud-based applications that support the management of email, contacts, calendars, media, documents and more. A server-side request forgery vulnerability exists in OX App Suite, which allows an attacker to learn about internal network configurations, open ports, a...

OX App Suite 7.8.4 - Multiple Vulnerabilities

Exploit for multiple platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 55872 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.8.4 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution...