1311 matches found
Open-Xchange Security Advisory 2015-02-12
Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35889 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.6.1 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version:...
Unspecified HTML Injection Vulnerability in Open-Xchange Server/OX App Suite
Open-Xchange Server is a partially open source project that develops collaborative software such as email, calendars, etc. OX App Suite is an integrated cloud environment that helps users manage their email, tasks, schedules, documents, etc. on any device. An unspecified HTML injection...
CVE-2014-8993
Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml MIME type...
CVE-2014-8993
Open-Xchange AppSuite has a backend XSS vulnerability (CVE-2014-8993) triggered by a crafted XHTML file with the application/xhtml+xml MIME type. Affected versions: 7.4.2-rev40 and earlier in the 7.4 line, 7.6.0-rev32 and earlier in the 7.6.0 line, and 7.6.1-rev11 and earlier in the 7.6.1 line. T...
CVE-2014-1679
CVE-2014-1679 affects Open-Xchange AppSuite prior to 7.2.2-rev31, 7.4.0 prior to 7.4.0-rev27, and 7.4.1 prior to 7.4.1-rev17.** The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file. The un...
CVE-2013-6241
Open-Xchange AppSuite (backend) Birthday widget flaw allows remote authenticated users to exfiltrate sensitive contact data (birthday, displayname, firstname, surname) via api/contacts?action=birthdays when birthdays fall next year. Root cause: incorrect SQL construction in certain user-id sharin...
CVE-2014-5237
Open-Xchange App Suite (documentconverter) is affected by CVE-2014-5237. The vulnerability allows Server-Side Request Forgery (SSRF) via a URL embedded in an image within a Text document, which is not correctly handled by the image preview. Affected versions are Open-Xchange App Suite before 7.4....
CVE-2014-7871
The CVE-2014-7871 issue affects Open-Xchange App Suite (OX App Suite) via the jslob API, enabling SQL injection through MySQL XPath interpreter (ExtractValue). Vulnerable in 7.6.x before 7.6.0-rev23 and 7.4.2-rev36; fixed versions are 7.4.2-rev36 and 7.6.0-rev23. Impact involves potential arbitra...
Open-Xchange Security Advisory 2014-11-07
Product: OX App Suite Vendor: Open-Xchange GmbH Internal reference: 34765 Bug ID Vulnerability type: SQL Injection CWE-89 Vulnerable version: 7.6.0 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Researcher credits: SoftScheck GmbH Fixed...
OX App Suite 7.6.0 SQL Injection Vulnerability
OX App Suite versions 7.6.0 and below suffer from a remote SQL injection vulnerability. Product: OX App Suite Vendor: Open-Xchange GmbH Internal reference: 34765 Bug ID Vulnerability type: SQL Injection CWE-89 Vulnerable version: 7.6.0 and earlier Vulnerable component: backend Report confidence:...
OX App Suite 7.6.0 SQL Injection
Product: OX App Suite Vendor: Open-Xchange GmbH Internal reference: 34765 Bug ID Vulnerability type: SQL Injection CWE-89 Vulnerable version: 7.6.0 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Researcher credits: SoftScheck GmbH Fixed...
Open-Xchange Security Advisory 2014-09-15
Product: OX App Suite Vendor: Open-Xchange GmbH Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.6.0 and earlier Vulnerable component: frontend Fixed version: 7.4.2-rev33, 7.6.0-rev16 Report confidence: Confirmed Solution status: Fixed by Vendor Vendor notification: 2014-07-1...
Cross site scripting
Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds...
CVE-2014-5234
Open-Xchange AppSuite (OX) backend is affected by CVE-2014-5234, a reflected XSS vulnerability that allows an attacker to inject arbitrary script/HTML via a folder publication name. Affected products include OX AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16. The issue is mitigated by up...
CVE-2014-5235
Open-Xchange App Suite frontend is affected by CVE-2014-5235. The vulnerability resides in the frontend code where RSS feed fields can inject arbitrary script/HTML, enabling XSS. Affected versions are Open-Xchange App Suite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16. The root cause is unsani...
CVE-2014-2077
Open-Xchange AppSuite frontend is affected by an XSS in the email subject field, due to unsafe handling of aria tags in the top bar. The vulnerability allows remote attackers to inject arbitrary script/HTML in the victim’s browser context when viewing emails. Remediation provided by the vendor fi...
CVE-2013-7142
Cross-site scripting XSS vulnerability in Open-Xchange OX AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions...
CVE-2013-7140
Open-Xchange AppSuite 7.4.1 and earlier is affected by an XML External Entity (XXE) vulnerability in the CalDAV interface (SAX builder and WebDAV). The issue can allow remote authenticated users to read portions of arbitrary files on the server. The root cause is characterized as XXE (and may inc...
CVE-2013-7142
Open-Xchange AppSuite (v7.4.1 and earlier) is affected by CVE-2013-7142, an XSS in the backend/frontend introduced via oAuth API calls that can allow an attacker to inject script within the user’s context. The vendor fixed this with patches in 7.2.2-rev29, 7.4.0-rev24, and 7.4.1-rev11; apply the ...