PT-2016-6667

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev5 Description An issue allows JavaScript code to be executed within a user's context when it is included in ical attachments within scheduling emails. This code can be presented to the user ...

PT-2016-7135

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows malicious script code to be executed within a user's context when a shared "Templates" folder is accessed from OX Documents settings. This occurs if the user's...

PT-2016-5820

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11 Description An issue in the login screen notification mechanism for external users allows the injection of arbitrary text messages. This can be exploited for social engineering attacks,...

PT-2016-7138

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue in Open-Xchange OX App Suite allows script code within hyperlinks at HTML emails to be executed when using base64 encoded data resources, due to incorrect sanitization...

PT-2016-7141

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows SVG files to be used as profile pictures, potentially leading to the execution of malicious script code within a user's context. This can occur when the XML...

CVE-2016-5740: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. Th...

CVE-2016-5124: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially...

PT-2016-5812

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev10 Description An issue in the App Suite frontend allows cookies with authentication information to be stored even when the user opts not to, specifically when using non-interactive login...

CVE-2016-6842: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...

CVE-2016-6853: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

CVE-2016-4026: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can...

CVE-2016-4027: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However t...

CVE-2016-6854: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...

PT-2016-5811

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11 Description An issue in the content sanitizer component allows malicious script code to be executed within a user's context when invalid HTML code is provided. This can lead to session...

CVE-2016-6844: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code c...

CVE-2016-4048: Undefined Security Weakness

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected...

PT-2016-7142

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue in Open-Xchange OX Guard allows script code to be provided as a parameter to the OX Guard guest reader web application, enabling cross-site scripting attacks against...

PT-2016-7144

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue allows script code and references to external websites to be injected into the names of PGP public keys. When a user requests the key later using a specific URL, the...

CVE-2016-4046: Server-Side Request Forgery (SSRF)

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response typ...

CVE-2016-4045: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed...