CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7143
https://notcve.org/view.php?id=CVE-2013-7143
17 Jan 2014 — Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule. Vulnerabilidad XSS en Open-Xchange (OX) AppSuite v7.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través del título en una regla de filtrado de correo. • http://seclists.org/bugtraq/2014/Jan/57 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7140
https://notcve.org/view.php?id=CVE-2013-7140
17 Jan 2014 — XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks. Vulnerabilidad en entidades externas XML (XXE) en la interfaz de CalDAV en Ope... • http://seclists.org/bugtraq/2014/Jan/57 •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6997
https://notcve.org/view.php?id=CVE-2013-6997
06 Jan 2014 — Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers." Multiple cross-site scripting (XSS) en Open-Xchange (OX) AppSuite 7.4.0 y anteriores que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) un correo electrónico HTML ... • http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-6242
https://notcve.org/view.php?id=CVE-2013-6242
26 Nov 2013 — Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions. Una vulnerabilidad de tipo cross-site scripting (XSS) en el front-end en Open-Xchange (OX) AppSuite versiones 6.22.3... • http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-6074
https://notcve.org/view.php?id=CVE-2013-6074
06 Nov 2013 — Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file. Vulnerabilidad de XSS en Open-Xchange (OX) AppSuite 7.2.x anterior a la versión 7.2.2-rev25 y 7.4.x anterior a 7.4.0-rev14 permite a atacantes remotos inyectar script web o HTML arbitrario a través de un archivo SVG adjunto. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0025.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2013-6241
https://notcve.org/view.php?id=CVE-2013-6241
06 Nov 2013 — The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday, displayname, firstname, and surname information via a birthdays action to api/contacts, aka bug 29315. El widget de Cumpleaños en el 'backend' en Open-Xchange (OX) AppSuite 7.2.x anterior a 7.2.2-rev25 y 7.4.x anter... • http://archives.neohapsis.com/archives/bugtraq/2013-11/0025.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 7EXPL: 0CVE-2013-6009
https://notcve.org/view.php?id=CVE-2013-6009
03 Oct 2013 — CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet. Vulnerabilidad de inyección CRLF en Open-Xchange AppSuite anterior a la versión 7.2.2, cuando se usa AJP en ciertas condiciones, permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de respuestas HTTP a través del servlet ajax/def... • http://www.securityfocus.com/archive/1/528940 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2013-5690
https://notcve.org/view.php?id=CVE-2013-5690
30 Sep 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment. Múltiples vulnerabilidades XSS en Open-Xchange AppSuite anterior a v7.2.2 permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a través de (1) contenido con el tipo text/xml MIME o (2) el campo comentario de S... • http://www.securityfocus.com/archive/1/528940 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2013-5934
https://notcve.org/view.php?id=CVE-2013-5934
25 Sep 2013 — Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different vulnerability than CVE-2013-5200. Open-Xchange AppSuite v7.0.x anterior a v7.0.2-rev15 y v7.2.x anterior a v7.2.2-rev16 tiene una contraseña incrustada para operaciones de adhesión de nodos, lo que permite a atacante... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-255: Credentials Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-5935
https://notcve.org/view.php?id=CVE-2013-5935
25 Sep 2013 — The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended location, a different vulnerability than CVE-2013-5200. La API Hazelcast cluster en Open-Xchange AppSuite v7.0.x anterior a v7.0.2-rev15 y v7.2.x anterior a v7.2.2-rev16 no restringe correctamente el conjunto de inte... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •