Malicious code in open-xchange-appsuite-spamexperts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2add34a6f5c10c787a6f1174f706cbb3513b8b883ad444090d2cd7874909eab9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-24701

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI...

PT-2021-11068 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for XSS via the app loading mechanism, specifically through the PATH INFO to the "/appsuite" URI. Recommendations: For OX App Suite versions 7.10.4 and earlier, update to ...

CVE-2014-5236

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

Path traversal

Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange OX AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted 1 OLE Object or 2 image in an OpenDocument text file...

CVE-2014-5236

CVE-2014-5236 affects Open-Xchange AppSuite, where the documentconverter component is vulnerable to absolute path traversal via crafted OLE Objects or images in OpenDocument text files. The impact is reading sensitive server files. Vendors provided fixes in versions: 7.4.2-rev10 and 7.6.0-rev10. ...

CVE-2014-5238

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

Xxe

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

CVE-2014-5238

CVE-2014-5238 concerns an XML external entity (XXE) vulnerability in Open-Xchange AppSuite. The OpenDocument Text handling allows expansion of XML entities (DTD recursive entities), enabling an attacker to read server files via a crafted document. The NVD entry notes the affected products as Open...

CVE-2014-5238

XML external entity XXE vulnerability in Open-Xchange OX AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-13687)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-14085)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

CVE-2013-7486

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...

CVE-2013-6242

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and th...

Cross site scripting

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and th...

Cross site scripting

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this...

Cross site scripting

Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...

CVE-2013-6242

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and th...

CVE-2013-6242

CVE-2013-6242 describes a cross-site scripting (XSS) flaw in the frontend of Open-Xchange (OX) AppSuite. It affects Open-Xchange AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12, where an attacker can inject arbitrary script/HTML via the subject of an email sent to the frontend. ...

CVE-2013-7486

Open-Xchange AppSuite contains a Cross-Site Scripting (XSS) vulnerability in the backend that allows remote attackers to inject script or HTML via the body of an email. Affected versions for this CVE-2013-7486 are Open-Xchange AppSuite 7.2.x prior to 7.2.2-rev27 and 7.4.x prior to 7.4.0-rev20. Th...