CVE-2014-2077: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'...

PT-2014-4470

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.4.1 through 7.4.1-rev9 Open-Xchange OX AppSuite versions 7.4.2 through 7.4.2-rev7 Description A cross-site scripting XSS issue exists in the frontend of Open-Xchange OX AppSuite, allowing remote attackers to...

CVE-2013-7142

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...

CVE-2013-7142

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...

CVE-2013-7142

Open-Xchange AppSuite (v7.4.1 and earlier) is affected by CVE-2013-7142, an XSS in the backend/frontend introduced via oAuth API calls that can allow an attacker to inject script within the user’s context. The vendor fixed this with patches in 7.2.2-rev29, 7.4.0-rev24, and 7.4.1-rev11; apply the ...

CVE-2013-7141

Open-Xchange AppSuite (Open-Xchange GmbH) suffers a Cross-site Scripting (XSS) vulnerability, CVE-2013-7141, in versions 7.4.1 and earlier. The issue arises from crafted

CVE-2013-7140

Open-Xchange AppSuite 7.4.1 and earlier is affected by an XML External Entity (XXE) vulnerability in the CalDAV interface (SAX builder and WebDAV). The issue can allow remote authenticated users to read portions of arbitrary files on the server. The root cause is characterized as XXE (and may inc...

PT-2014-3272

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.4.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via unspecified vectors...

CVE-2013-7143: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule...

CVE-2013-7142: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...

PT-2014-3273

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.4.1 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions. Recommendations For Open-Xchange OX AppSuite...

CVE-2013-7140: Undefined Security Weakness

XML External Entity XXE vulnerability in the CalDAV interface in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute pat...

PT-2014-3274

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite version 7.4.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule. Recommendations For Open-Xchange OX AppSuite version 7.4.1,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

CVE-2013-6997: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

CVE-2013-6074

CVE-2013-6074 affects Open-Xchange AppSuite: SVG-embedded script execution in attachments. Affected versions are Open-Xchange AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14. Root cause is embedding JavaScript within an SVG file, enabling remote attackers to inject arbitrary web sc...

PT-2013-5940

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.2.x through 7.2.2-rev24 Open-Xchange OX AppSuite versions 7.4.x through 7.4.0-rev13 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an attached...

CVE-2013-6074: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

Ox Design Cross Site Scripting / SQL Injection

1010101010101010101010101010101010101010101010101 0 0 1 /'\ /' /\ \ 1 0 /\ \ \ /, \ \ \ 0 1 //\ Dr.3v1l 0 1 0WebSecurity.IR 1 0 0 1 + E-Mail : [email protected] 1 0 + Y! : Doctor.3v1l 0 1 1 0 0 1 I'm 3v1l member from BlackDevils B0ys Team 1 0 0 1 1...

Open-Xchange Security Advisory 2013-06-03

Open-Xchange Security Advisory multiple vulnerabilities Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. The vendor has chosen a responsible full disclosure method to publish security issue details. Users of the software have already been provided...