open-xchange ox guard open-xchange ox guard vulnerabilities and exploits

(subscribe to this query)

6.5

CVSSv2

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard prior to 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Open-xchange Ox Guard Open-xchange Ox Guard

NA

Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured...

Open-xchange Ox Guard Open-xchange Ox Guard 2.10.7

4.3

CVSSv2

An issue exists in Open-Xchange OX Guard prior to 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting externa...

Open-xchange Ox Guard

1 EDB exploit

5

CVSSv2

OX Guard 2.10.4 and previous versions allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.

Open-xchange Ox Guard

3.5

CVSSv2

An issue exists in Open-Xchange OX Guard prior to 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token m...

Open-xchange Ox Guard

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard prior to 2.0.0-rev11 allows remote malicious users to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."

Open-xchange Ox Guard

4

CVSSv2

An issue exists in Open-Xchange Guard prior to 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the...

Open-xchange Ox Guard

4.3

CVSSv2

An issue exists in Open-Xchange OX Guard prior to 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or t...

Open-xchange Ox Guard

1 EDB exploit

4.3

CVSSv2

An issue exists in Open-Xchange OX Guard prior to 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can...

Open-xchange Ox Guard

1 EDB exploit

4.3

CVSSv2

OX Guard 2.10.3 and previous versions allows XSS.

Open-xchange Ox Guard 2.10.3

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook