Directory traversal

OX App Suite 7.8.4 and earlier allows Directory Traversal...

Server side request forgery (ssrf)

OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery...

CVE-2018-12610

OX App Suite 7.8.4 and earlier allows Information Exposure...

CVE-2018-12610

Open-Xchange OX App Suite backend component has an Information Disclosure vulnerability affecting versions 7.8.4 and 7.8.3. The issue allows exposure of email addresses (information exposure) and was addressed with fixes in 7.8.4-rev34 and 7.8.3-rev49 (public advisory disclosures reference CVE-20...

CVE-2018-12609

OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery...

CVE-2018-12611

OX App Suite 7.8.4 and earlier allows Directory Traversal...

CVE-2018-12609

OX App Suite (Open-Xchange) 7.8.4 and earlier is affected by a server-side request forgery (SSRF) in the backend content handling. Exploitation could cause the server to fetch arbitrary resources. Remediation: upgrade to 7.8.4-rev34 or 7.8.3-rev49 (fixed versions).

CVE-2018-12611

OX App Suite 7.8.4 and earlier is affected by a directory traversal vulnerability in the backend component. The issue arises from unexpected values of the content XML tag’s type parameter, which bypasses the content sanitizer and can disclose files. Affected versions: 7.8.4 and earlier; fixed in ...

Open-Xchange OX App Suite Cross Site Scripting / SSRF

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 59653 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.0 Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.0-rev13 Vendor notification:...

Ox App Suite 7.8.4 / 7.8.3 XSS / CSRF / Information Disclosure

Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs open-xchange, dovecot, powerdns at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange GmbH Product:...

ox-fanzine.de XSS vulnerability

Open Bug Bounty ID: OBB-707577 Description| Value ---|--- Affected Website:| ox-fanzine.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Cross site scripting

Cross-site scripting XSS vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page wit...

Open redirect

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-9997

Open-Xchange OX App Suite contains an XSS in mail compose that can be exploited via the data-target attribute in a data-toggle gadget. Affected products/versions: OX App Suite < 7.6.3-rev31, 7.8.x < 7.8.2-rev31, 7.8.3 < 7.8.3-rev41, 7.8.4

CVE-2018-9997

Cross-site scripting XSS vulnerability in mail compose in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev28 allows remote attackers to inject arbitrary web script or HTML via the data-target attribute in an HTML page wit...

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-9998

Open-Xchange OX App Suite CVE-2018-9998 affects 7.6.3-rev37 and 7.8.x lines, where folder names are exposed in API error responses for the folder parameter in the \

OX App Suite 7.8.4 XSS / XML Injection / Information Disclosure Vulnerabilities

OX App Suite version 7.8.5 suffers from XML external entity injection, information disclosure, and cross site scripting vulnerabilities. Product: OX App Suite Vendor: OX Software GmbH Internal reference: 58055 Bug ID Vulnerability type: XEE CWE-611 Vulnerable version: 7.8.4 Vulnerable component:...