PT-2016-5403

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.8.0-rev27 Description An issue in the "defer" servlet allows arbitrary URLs to be provided as redirection targets due to missing checks. This can trick users into following a link to a trustworthy...

PT-2016-7139

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows malicious script code to be executed within a user's context when SVG files containing script code are used as mp3 album covers. This can lead to session...

CVE-2016-6847: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This c...

PT-2016-5813

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.0-rev8 Description An issue in Open-Xchange OX Guard allows attackers to guess the correct padding of the authentication token by exploiting the API's behavior as a padding oracle. This is possible d...

PT-2016-7137

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue in Open-Xchange OX App Suite allows script code within SVG files to be maintained when opening such files in browser, based on the Mail or Drive app. This can lead to...

PT-2016-5402

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite versions prior to 7.8.0-rev27 Description An issue in Open-Xchange OX AppSuite allows the aria-label parameter of tiles at the Portal to be used for script code injection. This occurs when the name of a displayed file,...

PT-2016-7136

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.2-rev8 Description An issue allows script code to be injected into contact names. When these contacts are added to a group using autocomplete, the script code is executed in the context of the us...

CVE-2016-4028: Undefined Security Weakness

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

PT-2016-7144

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue allows script code and references to external websites to be injected into the names of PGP public keys. When a user requests the key later using a specific URL, the...

PT-2016-5820

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11 Description An issue in the login screen notification mechanism for external users allows the injection of arbitrary text messages. This can be exploited for social engineering attacks,...

CVE-2016-6853: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

PT-2016-7145

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.2-rev5 Description An issue in Open-Xchange OX Guard allows script code injected into a mail with an inline PGP signature to be executed when the signature is verified. This can lead to malicious...

Open-Xchange OX Guard Cross-Site Scripting Vulnerability (CNVD-2016-07643)

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A cross-site scripting vulnerability exists in Open-Xchange OX Guard 2.4.2 and prior versions, which stems from the program's failure to adequately filter user-submitted input. When a user...

Open-Xchange Guard 2.4.2 Cross Site Scripting

Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.4.0-rev11, 2.4.2-rev5...

Open-Xchange App Suite 7.8.2 - Cross Site Scripting

Exploit for cgi platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status:...

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities

Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed...

Open-Xchange Guard 2.4.2 - Multiple Cross Site Scripting

Exploit for linux platform in category web applications Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed...

Open-Xchange App Suite 7.8.2 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Email Attachment

Summary Improper handling of email attachments by "OX Guard" causes a Stored Cross-Site Scripting XSS vulnerability inside the OX "Mail" module. Injected code will be executed when the victim opens the HTML attachment of a decrypted email by using the "Open in browser" link/button. Proof of Conce...

Open-Xchange: OX Guard: DOM Based Cross-Site Scripting (#2)

Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. While this report is closely related to 158853, it is not a duplicate. I've had a look at the code introduced by commit 7fdbd307662f0041ed5e45b2f73c6530b79c6124, which I believe was supposed to protect against 158853. Today's repor...