CVE-2016-6852

Open-Xchange OX App Suite is affected by CVE-2016-6852. The vulnerability exists in versions prior to 7.8.2-rev8 and arises from allowing users to supply local file paths to the RSS reader. The response and error handling can reveal whether a given path exists, enabling attackers to enumerate spe...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-4026

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can...

CVE-2016-6848

CVE-2016-6848 affects Open-Xchange OX App Suite prior to 7.8.2-rev8. The issue allows via API requests to inject, generate and download executable files to the client using a Reflected File Download vector. A malicious platform-specific batch file can be created through a trusted domain without a...

CVE-2016-4045

Open-Xchange OX App Suite vulnerable to XSS via RSS feed links in versions before 7.8.1-rev11. Malicious script can run in the user’s context, enabling session hijacking or triggering actions via the web interface. Remediation observed in connected sources includes vendor fixes: 7.8.1-rev10 (and ...

CVE-2016-6853

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

CVE-2016-6851

CVE-2016-6851 (Open-Xchange OX Guard) vulnerability in Open-Xchange OX Guard before 2.4.2-rev5 allows cross-site scripting via the guest reader web application without authentication. Malicious script can execute in a user’s context, potentially causing session hijacking or triggering actions (e....

CVE-2016-6843: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code can be injected to contact names. When adding those contacts to a group, the script code gets executed in the context of the user which creates or changes the group by using autocomplete. In most cases this is a...

PT-2016-7138

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue in Open-Xchange OX App Suite allows script code within hyperlinks at HTML emails to be executed when using base64 encoded data resources, due to incorrect sanitization...

CVE-2016-6852: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give hints about whether the provided file exists or not. Attackers may discover specific system files or library versions on the middleware...

CVE-2016-6851: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...

CVE-2016-3173: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-4047: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker...

CVE-2016-6848: Undefined Security Weakness

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client "Reflected File Download". Malicious platform specific e.g. Microsoft Windows batch file can be created via a trusted domain without...

PT-2016-5819

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev8 Description An issue was discovered where references to external Open XML document type definitions .dtd resources can be placed within .docx and .xslx files. When parsing certain parts of...

PT-2016-7135

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows malicious script code to be executed within a user's context when a shared "Templates" folder is accessed from OX Documents settings. This occurs if the user's...

CVE-2016-6842: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...

PT-2016-6249

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev14 Description An issue in Open-Xchange OX App Suite allows for script code execution in the context of the active user when adding images from external sources to HTML editors by drag&drop...

PT-2016-7140

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows API requests to inject, generate, and download executable files to the client, known as "Reflected File Download". A malicious platform-specific batch file can ...

CVE-2016-6850: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser...