CVE-2016-4026

Open-Xchange OX App Suite (before 7.8.1-rev11) contains a vulnerability in the content sanitizer: when given invalid HTML, the filter may output an unsanitized representation, enabling malicious script execution in a user’s context and potential session hijacking or unintended actions via the web...

CVE-2016-3173

Open-Xchange OX AppSuite up to version 7.8.0-rev27 is affected by CVE-2016-3173. The aria-label parameter of Portal tiles can be used to inject script code, with labels derived from file names (e.g., images) displayed in the portal. This leads to script execution in a user’s context, enabling ses...

CVE-2016-4048

CVE-2016-4048 affects Open-Xchange OX App Suite before version 7.8.1-rev11. The login screen can display custom messages intended to inform external users about sharing-link issues, but this mechanism can be abused to inject arbitrary text, enabling social-engineering tricks that may mislead user...

CVE-2016-4045

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed...

CVE-2016-4028

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

CVE-2016-6844

Open-Xchange OX App Suite prior to 7.8.2-rev8 is affected by CVE-2016-6844. The issue arises from SVG script content being preserved when files are opened in browser via the Mail/Drive apps; within anchor tags, base64-encoded data references can allow malicious script execution in the user’s cont...

CVE-2016-4028

Open-Xchange OX Guard (before 2.4.0-rev8) is affected by a padding oracle flaw in the authentication token handling when using AES-CBC. The API may reveal padding validity via error codes, enabling brute-forcing of a guest token’s contents (OxReaderID cookie and auth parameter) to potentially dis...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability (CNVD-2016-07643)

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A cross-site scripting vulnerability exists in Open-Xchange OX Guard 2.4.2 and prior versions, which stems from the program's failure to adequately filter user-submitted input. When a user...

Open-Xchange Guard 2.4.2 Cross Site Scripting

Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.4.0-rev11, 2.4.2-rev5...

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed...

Open-Xchange Guard 2.4.2 - Multiple Cross Site Scripting

Exploit for linux platform in category web applications Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed...

Open-Xchange App Suite 7.8.2 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Open-Xchange App Suite 7.8.2 - Cross Site Scripting

Exploit for cgi platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status:...

Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Email Attachment

Summary Improper handling of email attachments by "OX Guard" causes a Stored Cross-Site Scripting XSS vulnerability inside the OX "Mail" module. Injected code will be executed when the victim opens the HTML attachment of a decrypted email by using the "Open in browser" link/button. Proof of Conce...

Open-Xchange: OX Guard: DOM Based Cross-Site Scripting (#2)

Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. While this report is closely related to 158853, it is not a duplicate. I've had a look at the code introduced by commit 7fdbd307662f0041ed5e45b2f73c6530b79c6124, which I believe was supposed to protect against 158853. Today's repor...

Open-Xchange: OX Guard: DOM Based Cross-Site Scripting

Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. The vulnerable parameter is "templid". The reader.js script see below takes the parameter's value and injects it into the page/DOM without encoding/sanitizing it first. PoC:...

Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Incoming Email

Summary "OX Guard" introduces a Stored Cross-Site Scripting XSS vulnerability to the frontend. HTML/JS code can be injected into the frontend through an incoming email. Injected code will be executed = become part of the DOM the moment the victim opens the email. The vulnerability allows for...

Open-Xchange OX Guard Security Bypass Vulnerability

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A security bypass vulnerability exists in versions 2.0 and 2.2.0 of Open-Xchange OX Guard, which can be exploited by attackers to bypass security restrictions and perform unauthorized...

Open-Xchange App Suite 7.8.1 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 45796 / 45811 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.1 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev44,...

Open-Xchange App Suite 7.8.1 Information Disclosure

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 45328 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.8.1 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev43,...