open-xchange open-xchange appsuite 7.2.1 vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

The password recovery service in Open-Xchange AppSuite prior to 7.2.2-rev20, 7.4.1 prior to 7.4.1-rev11, and 7.4.2 prior to 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote ...

Open-xchange Open-xchange Appsuite 7.4.2 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.4.1

4.3

CVSSv2

The E-Mail autoconfiguration feature in Open-Xchange AppSuite prior to 7.2.2-rev20, 7.4.1 prior to 7.4.1-rev11, and 7.4.2 prior to 7.4.2-rev13 places a password in a GET request, which allows remote malicious users to obtain sensitive information by reading (1) web-server access ...

Open-xchange Open-xchange Appsuite 7.4.2 Open-xchange Open-xchange Appsuite 7.4.1 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.2.0

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 prior to 7.4.1-rev11 and 7.4.2 prior to 7.4.2-rev13 allows remote malicious users to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an ...

Open-xchange Open-xchange Appsuite 7.4.2 Open-xchange Open-xchange Appsuite 7.4.1 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.2.1

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x prior to 7.2.2-rev25 and 7.4.x prior to 7.4.0-rev14 allows remote malicious users to inject arbitrary web script or HTML via an attached SVG file.

Open-xchange Open-xchange Appsuite 7.4.0 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.2

4

CVSSv2

The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x prior to 7.2.2-rev25 and 7.4.x prior to 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain...

Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.2 Open-xchange Open-xchange Appsuite 7.4.0

7.5

CVSSv2

The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x prior to 7.0.2-rev15 and 7.2.x prior to 7.2.2-rev16 do not require authentication, which allows remote malicious users to obtain sensitive information or modify data via an API ca...

Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.0.1

3.5

CVSSv2

Open-Xchange AppSuite prior to 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other ...

Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.2

4.3

CVSSv2

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x prior to 7.0.2-rev15 and 7.2.x prior to 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote malicious users to obtain access by sending network t...

Open-xchange Open-xchange Appsuite 7.0.1 Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.0

4

CVSSv2

Open-Xchange AppSuite 7.0.x prior to 7.0.2-rev15 and 7.2.x prior to 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote malicious users to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast clus...

Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.0.1

4.3

CVSSv2

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x prior to 7.0.2-rev15 and 7.2.x prior to 7.2.2-rev16 allows remote malicious users to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5)...

Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.0.1 Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.0

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook