open-xchange open-xchange appsuite 7.6.3 vulnerabilities and exploits

(subscribe to this query)

405

VMScore

The backend component in Open-Xchange OX App Suite prior to 7.6.3-rev35, 7.8.x prior to 7.8.2-rev38, 7.8.3 prior to 7.8.3-rev41, and 7.8.4 prior to 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.8.2

1 EDB exploit

383

VMScore

Cross-site scripting (XSS) vulnerability in mail compose in Open-Xchange OX App Suite prior to 7.6.3-rev31, 7.8.x prior to 7.8.2-rev31, 7.8.3 prior to 7.8.3-rev41, and 7.8.4 prior to 7.8.4-rev28 allows remote malicious users to inject arbitrary web script or HTML via the data-tar...

Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.8.4

405

VMScore

The frontend component in Open-Xchange OX App Suite prior to 7.6.3-rev31, 7.8.x prior to 7.8.2-rev31, 7.8.3 prior to 7.8.3-rev41, and 7.8.4 prior to 7.8.4-rev20 allows remote malicious users to spoof the origin of e-mails via unicode characters in the "personal part" of...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite

1 EDB exploit

405

VMScore

The backend component in Open-Xchange OX App Suite prior to 7.6.3-rev36, 7.8.x prior to 7.8.2-rev39, 7.8.3 prior to 7.8.3-rev44, and 7.8.4 prior to 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary ta...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.8.2

1 EDB exploit

356

VMScore

Open-Xchange OX App Suite prior to 7.6.3-rev37, 7.8.x prior to 7.8.2-rev40, 7.8.3 prior to 7.8.3-rev48, and 7.8.4 prior to 7.8.4-rev28 include folder names in API error responses, which allows remote malicious users to obtain sensitive information via the folder parameter in an &...

Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.8.2

405

VMScore

The backend component in Open-Xchange OX App Suite prior to 7.6.3-rev36, 7.8.x prior to 7.8.2-rev39, 7.8.3 prior to 7.8.3-rev44, and 7.8.4 prior to 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the ...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite 7.8.0

1 EDB exploit

655

VMScore

The backend component in Open-Xchange OX App Suite prior to 7.6.3-rev36, 7.8.x prior to 7.8.2-rev39, 7.8.3 prior to 7.8.3-rev44, and 7.8.4 prior to 7.8.4-rev22 allows remote malicious users to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal re...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite

1 EDB exploit

715

VMScore

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite prior to 7.6.3-rev3, 7.8.x prior to 7.8.2-rev4, 7.8.3 prior to 7.8.3-rev5, and 7.8.4 prior to 7.8.4-rev4 allows remote malicious users to read arbitrary files via a full pathname in a...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite

1 EDB exploit

383

VMScore

Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail prior to 7.6.3-rev28 allows remote malicious users to inject arbitrary web script or HTML via the event attribute in a time tag.

Open-xchange Open-xchange Appsuite

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook