Vendor CVEs
Open-Xchange
All CVEs
256 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-15030 | 0.00 | — | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | |||
| CVE-2017-17060 | 0.00 | — | 0.01 | May 23, 2019 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. | |||
| CVE-2017-17061 | 0.00 | — | 0.01 | May 23, 2019 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | |||
| CVE-2017-5210 | 0.00 | — | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. | |||
| CVE-2017-5211 | 0.00 | — | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. | |||
| CVE-2017-5212 | 0.00 | — | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. | |||
| CVE-2017-5213 | 0.00 | — | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | |||
| CVE-2017-5863 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||
| CVE-2017-5864 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | |||
| CVE-2017-6912 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||
| CVE-2017-8340 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||
| CVE-2017-8341 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. | |||
| CVE-2017-8777 | 0.00 | — | 0.01 | May 22, 2019 | Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. | |||
| CVE-2017-9809 | 0.00 | — | 0.01 | May 22, 2019 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. | |||
| CVE-2017-12884 | 0.00 | — | 0.01 | May 10, 2019 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. | |||
| CVE-2017-12885 | 0.00 | — | 0.01 | May 10, 2019 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | |||
| CVE-2018-13104 | 0.00 | — | 0.01 | Mar 17, 2019 | OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID) | |||
| CVE-2018-13103 | 0.00 | — | 0.01 | Mar 17, 2019 | OX App Suite 7.8.4 and earlier allows SSRF. | |||
| CVE-2018-12611 | 0.00 | — | 0.01 | Jan 29, 2019 | OX App Suite 7.8.4 and earlier allows Directory Traversal. | |||
| CVE-2018-12609 | 0.00 | — | 0.01 | Jan 29, 2019 | OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. | |||
| CVE-2018-12610 | 0.00 | — | 0.01 | Jan 29, 2019 | OX App Suite 7.8.4 and earlier allows Information Exposure. | |||
| CVE-2015-7385 | 0.00 | — | 0.02 | Nov 19, 2015 | Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings." | |||
| CVE-2015-5703 | 0.00 | — | 0.02 | Sep 28, 2015 | SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | |||
| CVE-2015-5375 | 0.00 | — | 0.02 | Sep 28, 2015 | Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject… | |||
| CVE-2014-9466 | 0.00 | — | 0.02 | Feb 17, 2015 | Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier." | |||
| CVE-2014-8993 | 0.00 | — | 0.02 | Jan 7, 2015 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml… | |||
| CVE-2014-1679 | 0.00 | — | 0.01 | Jan 5, 2015 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file. | |||
| CVE-2013-6241 | 0.00 | — | 0.01 | Dec 27, 2014 | The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain… | |||
| CVE-2014-5237 | 0.00 | — | 0.02 | Dec 1, 2014 | Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded… | |||
| CVE-2014-7871 | 0.00 | — | 0.02 | Nov 21, 2014 | SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call. | |||
| CVE-2014-5235 | 0.00 | — | 0.02 | Sep 17, 2014 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds. | |||
| CVE-2014-5234 | 0.00 | — | 0.02 | Sep 17, 2014 | Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name. | |||
| CVE-2014-2393 | 0.00 | — | 0.01 | Apr 24, 2014 | Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail… | |||
| CVE-2014-2392 | 0.00 | — | 0.01 | Apr 24, 2014 | The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2)… | |||
| CVE-2014-2391 | 0.00 | — | 0.01 | Apr 24, 2014 | The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote… | |||
| CVE-2014-2077 | 0.00 | — | 0.01 | Mar 20, 2014 | Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at… | |||
| CVE-2013-7143 | 0.00 | — | 0.01 | Jan 26, 2014 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule. | |||
| CVE-2013-7142 | 0.00 | — | 0.02 | Jan 26, 2014 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions. | |||
| CVE-2013-7141 | 0.00 | — | 0.02 | Jan 26, 2014 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to crafted "<%" tags. | |||
| CVE-2013-7140 | 0.00 | — | 0.02 | Jan 26, 2014 | XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been… | |||
| CVE-2013-6997 | 0.00 | — | 0.01 | Jan 9, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted… | |||
| CVE-2013-6074 | 0.00 | — | 0.01 | Nov 20, 2013 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file. | |||
| CVE-2013-6009 | 0.00 | — | 0.01 | Oct 3, 2013 | CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet. | |||
| CVE-2013-5690 | 0.00 | — | 0.01 | Oct 3, 2013 | Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment. | |||
| CVE-2013-5936 | 0.00 | — | 0.01 | Sep 25, 2013 | The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST… | |||
| CVE-2013-5935 | 0.00 | — | 0.01 | Sep 25, 2013 | The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic… | |||
| CVE-2013-5934 | 0.00 | — | 0.01 | Sep 25, 2013 | Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API… | |||
| CVE-2013-5200 | 0.00 | — | 0.01 | Sep 25, 2013 | The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call. | |||
| CVE-2013-5698 | 0.00 | — | 0.01 | Sep 5, 2013 | Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view… | |||
| CVE-2013-5035 | 0.00 | — | 0.01 | Sep 5, 2013 | Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and… |
- CVE-2017-15030May 23, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2017-17060May 23, 2019risk 0.00cvss —epss 0.01
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
- CVE-2017-17061May 23, 2019risk 0.00cvss —epss 0.01
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2017-5210May 23, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.
- CVE-2017-5211May 23, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
- CVE-2017-5212May 23, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control.
- CVE-2017-5213May 23, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2017-5863May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
- CVE-2017-5864May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2017-6912May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
- CVE-2017-8340May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
- CVE-2017-8341May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
- CVE-2017-8777May 22, 2019risk 0.00cvss —epss 0.01
Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization.
- CVE-2017-9809May 22, 2019risk 0.00cvss —epss 0.01
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.
- CVE-2017-12884May 10, 2019risk 0.00cvss —epss 0.01
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
- CVE-2017-12885May 10, 2019risk 0.00cvss —epss 0.01
OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- CVE-2018-13104Mar 17, 2019risk 0.00cvss —epss 0.01
OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)
- CVE-2018-13103Mar 17, 2019risk 0.00cvss —epss 0.01
OX App Suite 7.8.4 and earlier allows SSRF.
- CVE-2018-12611Jan 29, 2019risk 0.00cvss —epss 0.01
OX App Suite 7.8.4 and earlier allows Directory Traversal.
- CVE-2018-12609Jan 29, 2019risk 0.00cvss —epss 0.01
OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
- CVE-2018-12610Jan 29, 2019risk 0.00cvss —epss 0.01
OX App Suite 7.8.4 and earlier allows Information Exposure.
- CVE-2015-7385Nov 19, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."
- CVE-2015-5703Sep 28, 2015risk 0.00cvss —epss 0.02
SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2015-5375Sep 28, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject…
- CVE-2014-9466Feb 17, 2015risk 0.00cvss —epss 0.02
Open-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."
- CVE-2014-8993Jan 7, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev40, 7.6.0 before 7.6.0-rev32, and 7.6.1 before 7.6.1-rev11 allows remote attackers to inject arbitrary web script or HTML via a crafted XHTML file with the application/xhtml+xml…
- CVE-2014-1679Jan 5, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite before 7.2.2-rev31, 7.4.0 before 7.4.0-rev27, and 7.4.1 before 7.4.1-rev17 allows remote attackers to inject arbitrary web script or HTML via the header in an attached SVG file.
- CVE-2013-6241Dec 27, 2014risk 0.00cvss —epss 0.01
The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain…
- CVE-2014-5237Dec 1, 2014risk 0.00cvss —epss 0.02
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded…
- CVE-2014-7871Nov 21, 2014risk 0.00cvss —epss 0.02
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.
- CVE-2014-5235Sep 17, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.
- CVE-2014-5234Sep 17, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name.
- CVE-2014-2393Apr 24, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail…
- CVE-2014-2392Apr 24, 2014risk 0.00cvss —epss 0.01
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2)…
- CVE-2014-2391Apr 24, 2014risk 0.00cvss —epss 0.01
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote…
- CVE-2014-2077Mar 20, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at…
- CVE-2013-7143Jan 26, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule.
- CVE-2013-7142Jan 26, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions.
- CVE-2013-7141Jan 26, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to crafted "<%" tags.
- CVE-2013-7140Jan 26, 2014risk 0.00cvss —epss 0.02
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been…
- CVE-2013-6997Jan 9, 2014risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted…
- CVE-2013-6074Nov 20, 2013risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file.
- CVE-2013-6009Oct 3, 2013risk 0.00cvss —epss 0.01
CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet.
- CVE-2013-5690Oct 3, 2013risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment.
- CVE-2013-5936Sep 25, 2013risk 0.00cvss —epss 0.01
The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST…
- CVE-2013-5935Sep 25, 2013risk 0.00cvss —epss 0.01
The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic…
- CVE-2013-5934Sep 25, 2013risk 0.00cvss —epss 0.01
Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API…
- CVE-2013-5200Sep 25, 2013risk 0.00cvss —epss 0.01
The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call.
- CVE-2013-5698Sep 5, 2013risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view…
- CVE-2013-5035Sep 5, 2013risk 0.00cvss —epss 0.01
Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and…
Page 5 of 6