Open-Xchange Security Advisory 2015-02-12

Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35889 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.6.1 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version:...

CVE-2014-8993

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...

Cross site scripting

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...

CVE-2014-8993

Open-Xchange AppSuite has a backend XSS vulnerability (CVE-2014-8993) triggered by a crafted XHTML file with the application/xhtml+xml MIME type. Affected versions: 7.4.2-rev40 and earlier in the 7.4 line, 7.6.0-rev32 and earlier in the 7.6.0 line, and 7.6.1-rev11 and earlier in the 7.6.1 line. T...

CVE-2014-8993

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...

CVE-2014-1679

CVE-2014-1679 affects Open-Xchange AppSuite prior to 7.2.2-rev31, 7.4.0 prior to 7.4.0-rev27, and 7.4.1 prior to 7.4.1-rev17.** The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file. The un...

CVE-2013-6241

The Birthday widget in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday,...

CVE-2013-6241

Open-Xchange AppSuite (backend) Birthday widget flaw allows remote authenticated users to exfiltrate sensitive contact data (birthday, displayname, firstname, surname) via api/contacts?action=birthdays when birthdays fall next year. Root cause: incorrect SQL construction in certain user-id sharin...

CVE-2013-6241

The Birthday widget in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday,...

CVE-2014-5237

Server-side request forgery SSRF vulnerability in the documentconverter component in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in the documentconverter component in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text...

CVE-2014-5237

Open-Xchange App Suite (documentconverter) is affected by CVE-2014-5237. The vulnerability allows Server-Side Request Forgery (SSRF) via a URL embedded in an image within a Text document, which is not correctly handled by the image preview. Affected versions are Open-Xchange App Suite before 7.4....

CVE-2014-7871

SQL injection vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call...

Sql injection

SQL injection vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call...

CVE-2014-7871

The CVE-2014-7871 issue affects Open-Xchange App Suite (OX App Suite) via the jslob API, enabling SQL injection through MySQL XPath interpreter (ExtractValue). Vulnerable in 7.6.x before 7.6.0-rev23 and 7.4.2-rev36; fixed versions are 7.4.2-rev36 and 7.6.0-rev23. Impact involves potential arbitra...

CVE-2014-7871

SQL injection vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call...

CVE-2014-5234

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name...

CVE-2014-5235

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds...

Cross site scripting

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds...

Cross site scripting

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name...