CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7141
https://notcve.org/view.php?id=CVE-2013-7141
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to crafted "<%" tags. Vulnerabilidad XSS en Open-Xchange (OX) AppSuite v7.4.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de vectores no especificados relacionados con etiquetas "<%" manipuladas. • http://osvdb.org/102192 http://seclists.org/bugtraq/2014/Jan/57 http://www.securityfocus.com/bid/65009 http://www.securitytracker.com/id/1029650 https://exchange.xforce.ibmcloud.com/vulnerabilities/90544 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7142
https://notcve.org/view.php?id=CVE-2013-7142
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified oAuth API functions. Vulnerabilidad XSS en Open-Xchange (OX) AppSuite v7.4.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de funciones oAuth no especificadas de la API. • http://osvdb.org/102193 http://seclists.org/bugtraq/2014/Jan/57 http://www.securityfocus.com/bid/65012 http://www.securitytracker.com/id/1029650 https://exchange.xforce.ibmcloud.com/vulnerabilities/90545 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7143
https://notcve.org/view.php?id=CVE-2013-7143
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule. Vulnerabilidad XSS en Open-Xchange (OX) AppSuite v7.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través del título en una regla de filtrado de correo. • http://seclists.org/bugtraq/2014/Jan/57 http://www.osvdb.org/102195 http://www.securityfocus.com/bid/65013 http://www.securitytracker.com/id/1029650 https://exchange.xforce.ibmcloud.com/vulnerabilities/90546 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 10EXPL: 0CVE-2013-7140
https://notcve.org/view.php?id=CVE-2013-7140
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks. Vulnerabilidad en entidades externas XML (XXE) en la interfaz de CalDAV en Open-Xchange (OX) AppSuite 7.4.1 y anteriores permite a usuarios remotos autenticados leer porciones de archivos arbitrarios a través de vectores relacionados con el constructor de SAX y la interfaz de WebDAV. NOTA: este problema ha sido etiquetado como tanto como de recorrido ruta absoluta y XXE, pero la causa raiz puede ser XXE, ya XXE puede ser explotado para realizar el recorrido ruta absoluta y otros ataques. • http://seclists.org/bugtraq/2014/Jan/57 http://www.osvdb.org/102194 http://www.securityfocus.com/bid/65015 http://www.securitytracker.com/id/1029650 https://exchange.xforce.ibmcloud.com/vulnerabilities/90543 •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6997
https://notcve.org/view.php?id=CVE-2013-6997
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers." Multiple cross-site scripting (XSS) en Open-Xchange (OX) AppSuite 7.4.0 y anteriores que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) un correo electrónico HTML con código CSS manipulado que contiene caracteres comodín o (2) la oficina documentos que contienen "hipervínculos manipulados con manejadores de script de URL." • http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf http://www.osvdb.org/101714 http://www.osvdb.org/101715 http://www.securityfocus.com/archive/1/530681/100/0/threaded http://www.securityfocus.com/bid/64676 http://www.securitytracker.com/id/1029554 https://exchange.xforce.ibmcloud.com/vulnerabilities/90113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •