open-xchange open-xchange appsuite office vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend prior to 7.6.2-rev59, 7.8.0 prior to 7.8.0-rev38, 7.8.2 prior to 7.8.2-rev8; AppSuite frontend prior to 7.6.2-rev47, 7.8.0 prior to 7.8.0-rev30, and 7.8.2 prior to 7.8.2-rev8; Office Web prior to 7.6.2...

Open-xchange Open-xchange Appsuite Frontend 7.6.2 Open-xchange Open-xchange Appsuite Backend 7.8.0 Open-xchange Open-xchange Appsuite Backend 7.8.2 Open-xchange Open-xchange Appsuite Backend 7.6.2 Open-xchange Office Web 7.8.0 Open-xchange Open-xchange Appsuite Frontend 7.8.0 Open-xchange Documentconverter-api 7.8.2 Open-xchange Office Web 7.8.2 Open-xchange Office Web 7.6.2 Open-xchange Open-xchange Appsuite Frontend 7.8.2

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and previous versions allow remote malicious users to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing &q...

Open-xchange Open-xchange Appsuite 6.20.7 Open-xchange Open-xchange Appsuite 6.22.0 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.0.2 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 6.22.1 Open-xchange Open-xchange Appsuite 7.0.1 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 7.2.2

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached...

Open-xchange Open-xchange Appsuite Office

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have ...

Open-xchange Open-xchange Appsuite Office

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are ac...

Open-xchange Open-xchange Appsuite Office

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control ...

Open-xchange Open-xchange Appsuite Office

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite prior to 7.8.3-rev12 and 7.8.4 prior to 7.8.4-rev9 allows remote malicious users to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite

1 EDB exploit

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook