CVE-2013-6997

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

PT-2014-3245

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions 7.4.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via specific means, including HTML emails with crafted CSS code containing wildcards or office documents...

CVE-2013-6997: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange OX AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an HTML email with crafted CSS code containing wildcards or 2 office documents containing "crafted hyperlinks with script URL handler...

Open-Xchange Security Advisory 2013-11-25

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 29648 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 6.22.4 and earlier Vulnerable component: frontend6 Fixed version: 6.22.3-rev5, 6.22.4-rev12...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

CVE-2013-6074

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

CVE-2013-6074

CVE-2013-6074 affects Open-Xchange AppSuite: SVG-embedded script execution in attachments. Affected versions are Open-Xchange AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14. Root cause is embedding JavaScript within an SVG file, enabling remote attackers to inject arbitrary web sc...

PT-2013-5940

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions 7.2.x through 7.2.2-rev24 Open-Xchange OX AppSuite versions 7.4.x through 7.4.0-rev13 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an attached...

CVE-2013-6074: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file...

Open-Xchange Security Advisory 2013-11-06

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 29147 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: prior to 7.4.0 Vulnerable component: backend Fixed version: 7.2.2-rev25, 7.4.0-rev14 Report...

CVE-2013-6009

CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 content with the text/xml MIME type or 2 the Status comment field of an appointment...

Crlf injection

CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet...

CVE-2013-6009

Open-Xchange AppSuite is affected by a CRLF injection vulnerability (CVE-2013-6009) present before version 7.2.2 when using AJP under certain conditions. An attacker can inject arbitrary HTTP headers and trigger HTTP response splitting via the ajax/defer servlet. Affected product: Open-Xchange Ap...

CVE-2013-6009

CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet...

CVE-2013-5690

CVE-2013-5690 affects Open-Xchange AppSuite prior to 7.2.2. The issue is cross-site scripting vulnerabilities allowing remote authenticated users to inject script/HTML through (1) content with the text/xml MIME type and (2) the Status comment field of an appointment. Root cause relates to inadequ...

PT-2013-5918

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.2.2 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet when AJP is used in certain conditions...

PT-2013-5726

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.2.2 Description The issue allows remote authenticated users to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This can be achieved via content with the text/xm...

CVE-2013-5690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 content with the text/xml MIME type or 2 the Status comment field of an appointment...