Open redirect

The Birthday widget in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday,...

CVE-2013-6241

Open-Xchange AppSuite (backend) Birthday widget flaw allows remote authenticated users to exfiltrate sensitive contact data (birthday, displayname, firstname, surname) via api/contacts?action=birthdays when birthdays fall next year. Root cause: incorrect SQL construction in certain user-id sharin...