Open-Xchange OX AppSuite 7.8.0 XSS / Open Redirect

Product: OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 44542 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.0 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed versions: 7.6.2-rev40, 7.6.3-rev...

CVE-2015-7385

Cross-site scripting XSS vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."...

CVE-2015-7385

Open-Xchange OX Guard up to version 2.0.0-rev11 is affected by a Cross-site scripting (XSS) flaw in the Guard PGP Settings. The uid field in a PGP public key can carry arbitrary user-id content that may be rendered in the affected UI, enabling remote attackers to inject JavaScript/HTML. Public ke...

CVE-2015-7385

Cross-site scripting XSS vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability

Open-Xchange OX Guard is a security suite for email and documents. A cross-site scripting vulnerability exists in Open-Xchange OX Guard. This vulnerability can be exploited by remote attackers to execute arbitrary script code within the context of a user's browser program and steal cookie-based...

odl.ox.ac.uk XSS vulnerability

Vulnerable URL: http://www.odl.ox.ac.uk/balladoperas/search.php?sub2=1=0=srch=glubz%22%3E%3Cimg%20src=x%20onerror=window.onerror=alert;throw/xssposed/;//%3E%3C Details: Description| Value ---|--- Patched:| Yes, at 15.11.2015 Latest check for patch:| 15.11.2015 01:26 GMT Vulnerability type:| XSS...

Open-Xchange (OX) App Suite Email Subject Cross Site Scripting Vulnerability

OpenX is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Open-Xchange (OX) App Suite Email Configuration Information Disclosure Vulnerability

Open-Xchange OX App Suite is prone to an information disclosure vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

Open-Xchange OX Guard SQL Injection Vulnerability

Open-Xchange OX Guard is a security suite for email and documents. A SQL injection vulnerability exists in the public key discovery API calls of Open-Xchange OX Guard, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain...

CVE-2015-5703

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5375

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

Cross site scripting

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

Sql injection

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5375

Open-Xchange Server 6 / OX App Suite are affected by CVE-2015-5375: a cross-site scripting vulnerability in front-end dialogs used for printing content, related to object properties. Affected versions include Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, ...

CVE-2015-5375

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

CVE-2015-5703

Open-Xchange OX Guard contains a SQL injection vulnerability in the public key discovery API calls prior to version 2.0.0-rev8. The flaw allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Mitigation is to upgrade to 2.0.0-rev8 or later (as per the linked ...

CVE-2015-5703

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Open redirect

Open-Xchange OX AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."...

CVE-2014-9466

Open-Xchange Open-Xchange AppSuite/Server (Open-Xchange Server 6 / OX AppSuite) is affected by a directory-permissions handling issue in the backend that allows remote authenticated users to read files via unspecified vectors related to the folder identifier. The vulnerability is an information d...