CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2013-5690
https://notcve.org/view.php?id=CVE-2013-5690
30 Sep 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment. Múltiples vulnerabilidades XSS en Open-Xchange AppSuite anterior a v7.2.2 permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a través de (1) contenido con el tipo text/xml MIME o (2) el campo comentario de S... • http://www.securityfocus.com/archive/1/528940 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2013-5934
https://notcve.org/view.php?id=CVE-2013-5934
25 Sep 2013 — Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows remote attackers to expand a cluster by finding this password in the source code and then sending the password in a Hazelcast cluster API call, a different vulnerability than CVE-2013-5200. Open-Xchange AppSuite v7.0.x anterior a v7.0.2-rev15 y v7.2.x anterior a v7.2.2-rev16 tiene una contraseña incrustada para operaciones de adhesión de nodos, lo que permite a atacante... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-255: Credentials Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-5935
https://notcve.org/view.php?id=CVE-2013-5935
25 Sep 2013 — The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended location, a different vulnerability than CVE-2013-5200. La API Hazelcast cluster en Open-Xchange AppSuite v7.0.x anterior a v7.0.2-rev15 y v7.2.x anterior a v7.2.2-rev16 no restringe correctamente el conjunto de inte... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2013-5936
https://notcve.org/view.php?id=CVE-2013-5936
25 Sep 2013 — The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 allows remote attackers to obtain sensitive information about (1) runtime activity, (2) network configuration, (3) user sessions, (4) the memcache interface, and (5) the REST interface via API calls such as a hazelcast/rest/cluster/ call, a different vulnerability than CVE-2013-5200. La API Hazelcast cluster en Open-Xchange AppSuite v7.0.x anterior a v7.0.2-rev15 y v7.2.x anterior a v7.2.2-rev16 permite ... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 1%CPEs: 4EXPL: 1CVE-2013-5200 – Open-Xchange AppSuite 7.2.2 Improper Authentication / Information Disclosure
https://notcve.org/view.php?id=CVE-2013-5200
10 Sep 2013 — The (1) REST and (2) memcache interfaces in the Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 do not require authentication, which allows remote attackers to obtain sensitive information or modify data via an API call. Los interfaces (1) REST y (2) memcache en Hazelcast cluster API de Open-Xchange AppSuite 7.0.x (anteriores a 7.0.2-rev15) y 7.2.x (anteriores a 7.2.2-rev16) no requieren autenticación, lo que permite a atacantes remotos obtener informació... • http://archives.neohapsis.com/archives/bugtraq/2013-09/0032.html • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 10EXPL: 0CVE-2013-5698
https://notcve.org/view.php?id=CVE-2013-5698
05 Sep 2013 — Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite and Server before 6.22.0 rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allows remote authenticated users to inject arbitrary web script or HTML via a delivery=view action, aka Bug ID 26373, a different vulnerability than CVE-2013-3106. Vulnerabilidad Cross-site scripting (XSS) en Open-Xchange AppSuite y Server anterior a v6.22.0 rev16, v6.22.1 anterior a rev19, v7.0.1 anterior a rev7, v7.0.2 anterior... • http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 20EXPL: 2CVE-2013-5035
https://notcve.org/view.php?id=CVE-2013-5035
16 Aug 2013 — Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations. Múltiples vulnerabilidades de condición de carrera en HtmlCleaner anterior a v2.6, como es utilizado en Open-Xchange AppSuite v7.2.2 anterior a rev13 y otros prod... • http://archives.neohapsis.com/archives/bugtraq/2013-08/0115.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2013-4790 – Open-Xchange AppSuite 7.2.2 Phishing / Data Injection
https://notcve.org/view.php?id=CVE-2013-4790
01 Aug 2013 — Open-Xchange AppSuite before 7.0.2 rev14, 7.2.0 before rev11, 7.2.1 before rev10, and 7.2.2 before rev9 relies on user-supplied data to predict the IMAP server hostname for an external domain name, which allows remote authenticated users to discover e-mail credentials of other users in opportunistic circumstances via a manual-mode association of a personal e-mail address with the hostname of a crafted IMAP server. Múltiples vulnerabilidades XSS en Open-Xchange AppSuite, 7.0.2 rev14, 7.2.0 anteior a rev11, 7... • http://archives.neohapsis.com/archives/bugtraq/2013-07/0204.html • CWE-255: Credentials Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0CVE-2013-3106
https://notcve.org/view.php?id=CVE-2013-3106
03 Jun 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via (1) embedded VBScript, (2) object/data Base64 content, (3) a Content-Type header, or (4) UTF-16 encoding, aka Bug IDs 25957, 26237, 26243, and 26244. Múltiples vulnerabilidades XSS en Open-Xchange AppSuite y Server anterior a 6.20.7 r... • http://archives.neohapsis.com/archives/bugtraq/2013-06/0012.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2013-2582
https://notcve.org/view.php?id=CVE-2013-2582
17 Apr 2013 — CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitization of whitespace characters. Vulnerabilidad de inyección CRLF en el servlet para redirigir en Open-Xchange AppSuite y Server anterior a v6.22.0 rev15, v6.22.1 anterior a rev17, v7.0.1 anterior a rev6, y v7.0.2 anteri... • http://archives.neohapsis.com/archives/bugtraq/2013-04/0183.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •