CVE-2013-5035

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

CVE-2013-2582

CVE-2013-2582 affects Open-Xchange Server 6 / OX AppSuite. The vulnerability is a CRLF injection in the redirect servlet caused by insufficient whitespace sanitization, enabling attackers to inject HTTP headers and perform open redirects. Affected fixed versions per vendor advisory: 6.22.0-rev15,...

CVE-2013-4790

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-4790

Open-Xchange AppSuite is affected by CVE-2013-4790. Versions prior to 7.0.2 rev14, 7.2.0 rev11, 7.2.1 rev10, and 7.2.2 rev9 rely on user-supplied data to predict the IMAP server hostname for an external domain, enabling remote authenticated users to discover other users’ email credentials through...

PT-2013-3851

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.22.0 rev15 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev17 Open-Xchange AppSuite and Server versions 7.0.1 prior to rev6 Open-Xchange AppSuite and Server versions 7.0.2 prior...

PT-2013-5341

Name of the Vulnerable Software and Affected Versions HtmlCleaner versions prior to 2.6 Open-Xchange AppSuite version 7.2.2 before rev13 Description The issue is related to multiple race conditions that can be exploited by remote authenticated users. This can happen in opportunistic circumstances...

PT-2013-4138

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.20.7 rev18 Open-Xchange AppSuite and Server versions 6.22.0 prior to rev16 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev19 Open-Xchange AppSuite and Server versions 7.0.1 pri...

PT-2013-5196

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.0.2 rev14 Open-Xchange AppSuite versions 7.2.0 prior to rev11 Open-Xchange AppSuite versions 7.2.1 prior to rev10 Open-Xchange AppSuite versions 7.2.2 prior to rev9 Description The issue relies on...

CVE-2013-2582: Improper Control of Generation of Code

CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitizatio...

CVE-2013-4790: Undefined Security Weakness

Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in...

CVE-2013-5035: Concurrent Execution using Shared Resource with Improper Synchronization

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

CVE-2013-5698: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, ...

CVE-2013-2583: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL, 2 malformed nested...

CVE-2013-3106: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

PT-2013-3852

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.20.7 rev16 Open-Xchange AppSuite and Server versions 6.22.0 prior to rev15 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev17 Open-Xchange AppSuite and Server versions 7.0.1 pri...

PT-2013-5734

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite and Server versions prior to 6.22.0 rev16 Open-Xchange AppSuite and Server versions 6.22.1 prior to rev19 Open-Xchange AppSuite and Server versions 7.0.1 prior to rev7 Open-Xchange AppSuite and Server versions 7.0.2 prior...

Open-Xchange Security Advisory 2013-06-03

Open-Xchange Security Advisory multiple vulnerabilities Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. The vendor has chosen a responsible full disclosure method to publish security issue details. Users of the software have already been provided...