Sql injection

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5703

Open-Xchange OX Guard contains a SQL injection vulnerability in the public key discovery API calls prior to version 2.0.0-rev8. The flaw allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Mitigation is to upgrade to 2.0.0-rev8 or later (as per the linked ...

CVE-2015-5703

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5375

Open-Xchange Server 6 / OX App Suite are affected by CVE-2015-5375: a cross-site scripting vulnerability in front-end dialogs used for printing content, related to object properties. Affected versions include Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, ...

CVE-2015-5375

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

PT-2015-6877

Name of the Vulnerable Software and Affected Versions Open-Xchange Server versions prior to 6.22.8-rev8 Open-Xchange Server versions 6.22.9 prior to 6.22.9-rev15m OX App Suite versions 7.x prior to 7.6.1-rev25 OX App Suite versions 7.6.2 prior to 7.6.2-rev20 Description A cross-site scripting XSS...

CVE-2015-5375: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

PT-2015-7044

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.0.0-rev8 Description The issue concerns a SQL injection vulnerability in the public key discovery API call. This allows remote authenticated users to execute arbitrary SQL commands. Recommendations For...

CVE-2015-5703: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Open redirect

Open-Xchange OX AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."...

CVE-2014-9466

Open-Xchange Open-Xchange AppSuite/Server (Open-Xchange Server 6 / OX AppSuite) is affected by a directory-permissions handling issue in the backend that allows remote authenticated users to read files via unspecified vectors related to the folder identifier. The vulnerability is an information d...

Open-Xchange Security Advisory 2015-02-12

Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35889 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.6.1 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version:...

Unspecified HTML Injection Vulnerability in Open-Xchange Server/OX App Suite

Open-Xchange Server is a partially open source project that develops collaborative software such as email, calendars, etc. OX App Suite is an integrated cloud environment that helps users manage their email, tasks, schedules, documents, etc. on any device. An unspecified HTML injection...

CVE-2014-8993

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...

CVE-2014-8993

Open-Xchange AppSuite has a backend XSS vulnerability (CVE-2014-8993) triggered by a crafted XHTML file with the application/xhtml+xml MIME type. Affected versions: 7.4.2-rev40 and earlier in the 7.4 line, 7.6.0-rev32 and earlier in the 7.6.0 line, and 7.6.1-rev11 and earlier in the 7.6.1 line. T...

PT-2015-4133

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.4.2-rev40 Open-Xchange OX AppSuite versions 7.6.0 prior to 7.6.0-rev32 Open-Xchange OX AppSuite versions 7.6.1 prior to 7.6.1-rev11 Description A cross-site scripting XSS issue exists in the backend...

CVE-2014-8993: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...

CVE-2014-1679

CVE-2014-1679 affects Open-Xchange AppSuite prior to 7.2.2-rev31, 7.4.0 prior to 7.4.0-rev27, and 7.4.1 prior to 7.4.1-rev17.** The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file. The un...

CVE-2014-1679: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file...

CVE-2013-6241

Open-Xchange AppSuite (backend) Birthday widget flaw allows remote authenticated users to exfiltrate sensitive contact data (birthday, displayname, firstname, surname) via api/contacts?action=birthdays when birthdays fall next year. Root cause: incorrect SQL construction in certain user-id sharin...