Design/Logic Flaw

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

CVE-2016-5740

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. Th...

CVE-2016-6850

The CVE-2016-6850 issue affects Open-Xchange OX App Suite before 7.8.2-rev8, where SVG profile pictures can carry iframes and script in their XML. This allows malicious script execution in a user’s browser context, potentially leading to session hijacking or unintended actions (e.g., sending mail...

CVE-2016-6851

CVE-2016-6851 (Open-Xchange OX Guard) vulnerability in Open-Xchange OX Guard before 2.4.2-rev5 allows cross-site scripting via the guest reader web application without authentication. Malicious script can execute in a user’s context, potentially causing session hijacking or triggering actions (e....

CVE-2016-6842

Open-Xchange OX App Suite prior to 7.8.2-rev8 contains a cross-site scripting issue in which setting a user’s name to JavaScript code causes that code to execute when the victim accesses the user’s shared Templates folder via OX Documents. The attack requires the folder to be shared to the victim...

CVE-2016-6843

Open-Xchange OX App Suite before 7.8.2-rev8 is affected. When adding contacts to a group via autocomplete, script code can be injected and executed in the context of the user creating or changing the group, potentially leading to session hijacking or unwanted actions in the web interface (e.g., s...

CVE-2016-5124

Open-Xchange OX App Suite (frontend) is affected by CVE-2016-5124. Before 7.8.1-rev14, dragging and dropping images from external sources into HTML editors (e.g., E‑Mail Compose, OX Text) can inject script code in the user’s context, bypassing XSS filters. Exploitation requires user social engine...

CVE-2016-5740

CVE-2016-5740 affects Open-Xchange OX App Suite up to 7.8.2-rev5; JavaScript in iCal attachments within scheduling emails can execute in the user’s session, enabling malicious code execution, possible session hijacking, or triggering actions (e.g., sending mail, deleting data). Root cause: unsafe...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-6851

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be execute...

CVE-2016-6842

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed...

CVE-2016-6854

CVE-2016-6854 affects Open-Xchange OX Guard prior to 2.4.2-rev5. An injection flaw allows a script to run when verifying an inline PGP signature in a mail, enabling malicious code to execute in a user’s context and potentially hijack sessions or trigger actions via the web interface. Fixed in 2.4...

CVE-2016-6853

Open-Xchange OX Guard (vulnerable: 2.4.2-rev5 and earlier) contains a cross-site scripting flaw where script code can be injected into PGP public key names. When a user later fetches the key via a specific URL, the injected script may execute in the user’s context, potentially leading to phishing...

CVE-2016-6853

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...

CVE-2016-3173

Open-Xchange OX AppSuite up to version 7.8.0-rev27 is affected by CVE-2016-3173. The aria-label parameter of Portal tiles can be used to inject script code, with labels derived from file names (e.g., images) displayed in the portal. This leads to script execution in a user’s context, enabling ses...

CVE-2016-6844

Open-Xchange OX App Suite prior to 7.8.2-rev8 is affected by CVE-2016-6844. The issue arises from SVG script content being preserved when files are opened in browser via the Mail/Drive apps; within anchor tags, base64-encoded data references can allow malicious script execution in the user’s cont...

CVE-2016-4045

Open-Xchange OX App Suite vulnerable to XSS via RSS feed links in versions before 7.8.1-rev11. Malicious script can run in the user’s context, enabling session hijacking or triggering actions via the web interface. Remediation observed in connected sources includes vendor fixes: 7.8.1-rev10 (and ...

CVE-2016-4026

Open-Xchange OX App Suite (before 7.8.1-rev11) contains a vulnerability in the content sanitizer: when given invalid HTML, the filter may output an unsanitized representation, enabling malicious script execution in a user’s context and potential session hijacking or unintended actions via the web...

CVE-2016-6847

Open-Xchange OX App Suite prior to 7.8.2-rev8 is affected by CVE-2016-6847. The issue allows an attacker to embed script-enabled SVG files used as mp3 album covers; if the SVG XML includes script code, it may execute when the related cover URL is accessed, enabling code execution in the user’s br...

CVE-2016-6850

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser...