OpenXchange XSS

Dangerous content from application/xhtml+xml is not removed...

PT-2015-4133

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.4.2-rev40 Open-Xchange OX AppSuite versions 7.6.0 prior to 7.6.0-rev32 Open-Xchange OX AppSuite versions 7.6.1 prior to 7.6.1-rev11 Description A cross-site scripting XSS issue exists in the backend...

CVE-2014-8993: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...