CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26445
https://notcve.org/view.php?id=CVE-2023-26445
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. • http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2023/Aug/8 https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2016-6846
https://notcve.org/view.php?id=CVE-2016-6846
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML. Vulnerabilidad XSS en Open-Xchange (OX) AppSuite backend en versiones anteriores a 7.6.2-rev59, 7.8.0 en versiones anteriores a 7.8.0-rev38, 7.8.2 en versiones anteriores a 7.8.2-rev8; interfaz AppSuite en versiones anteriores a 7.6.2-rev47, 7.8.0 en versiones anteriores a 7.8.0-rev30 y 7.8.2 en versiones anteriores a 7.8.2-rev8; Office Web en versiones anteriores a 7.6.2-rev16, 7.8.0 en versiones anteriores a 7.8.0-rev10 y 7.8.2 en versiones anteriores a 7.8.2-rev5; y Documentconverter-API en versiones anteriores a 7.8.2-rev5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios. • http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_3520_7.8.0_2016-08-29.pdf http://www.securityfocus.com/bid/93457 https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3518_7.6.2_2016-08-29.pdf https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •