open-xchange appsuite frontend vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend prior to 7.6.2-rev59, 7.8.0 prior to 7.8.0-rev38, 7.8.2 prior to 7.8.2-rev8; AppSuite frontend prior to 7.6.2-rev47, 7.8.0 prior to 7.8.0-rev30, and 7.8.2 prior to 7.8.2-rev8; Office Web prior to 7.6.2...

Open-xchange Open-xchange Appsuite Frontend 7.6.2 Open-xchange Open-xchange Appsuite Backend 7.8.0 Open-xchange Open-xchange Appsuite Backend 7.8.2 Open-xchange Open-xchange Appsuite Backend 7.6.2 Open-xchange Office Web 7.8.0 Open-xchange Open-xchange Appsuite Frontend 7.8.0 Open-xchange Documentconverter-api 7.8.2 Open-xchange Office Web 7.8.2 Open-xchange Office Web 7.6.2 Open-xchange Open-xchange Appsuite Frontend 7.8.2

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the w...

Open-xchange Open-xchange Appsuite Frontend

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To ex...

Open-xchange Open-xchange Appsuite Frontend

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hi...

Open-xchange Open-xchange Appsuite Frontend

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and...

Open-xchange Open-xchange Appsuite Frontend

The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To ...

Open-xchange Open-xchange Appsuite Frontend

The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To...

Open-xchange Open-xchange Appsuite Frontend

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite prior to 7.4.2-rev33 and 7.6.x prior to 7.6.0-rev16 allows remote malicious users to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.

Open-xchange Open-xchange Appsuite 6.22.0 Open-xchange Open-xchange Appsuite 6.22.1 Open-xchange Open-xchange Appsuite 7.6.0 Open-xchange Open-xchange Appsuite 7.2.0 Open-xchange Open-xchange Appsuite 7.2.1 Open-xchange Open-xchange Appsuite 6.20.7 Open-xchange Open-xchange Appsuite 7.2.2 Open-xchange Open-xchange Appsuite 7.4.0 Open-xchange Open-xchange Appsuite Open-xchange Open-xchange Appsuite 7.0.1 Open-xchange Open-xchange Appsuite 7.0.2

The frontend component in Open-Xchange OX App Suite prior to 7.6.3-rev31, 7.8.x prior to 7.8.2-rev31, 7.8.3 prior to 7.8.3-rev41, and 7.8.4 prior to 7.8.4-rev20 allows remote malicious users to spoof the origin of e-mails via unicode characters in the "personal part" of...

Open-xchange Open-xchange Appsuite 7.8.4 Open-xchange Open-xchange Appsuite 7.8.3 Open-xchange Open-xchange Appsuite 7.6.3 Open-xchange Open-xchange Appsuite 7.8.0 Open-xchange Open-xchange Appsuite 7.8.2 Open-xchange Open-xchange Appsuite

1 EDB exploit

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 prior to 6.22.3-rev5 and 6.22.4 prior to 6.22.4-rev12 allows remote malicious users to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related ...

Open-xchange Open-xchange Appsuite 6.22.3 Open-xchange Open-xchange Appsuite 6.22.4 Open-xchange Open-xchange Appsuite 7.2.2 Open-xchange Open-xchange Appsuite 7.4.0

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook