Page 28 of 151 results (0.005 seconds)

CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6997

https://notcve.org/view.php?id=CVE-2013-6997

Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an HTML email with crafted CSS code containing wildcards or (2) office documents containing "crafted hyperlinks with script URL handlers." Multiple cross-site scripting (XSS) en Open-Xchange (OX) AppSuite 7.4.0 y anteriores que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) un correo electrónico HTML con código CSS manipulado que contiene caracteres comodín o (2) la oficina documentos que contienen "hipervínculos manipulados con manejadores de script de URL." • http://software.open-xchange.com/OX6/doc/Release_Notes_for_Public_Patch_Release_1766_7.4.0_Rev21_2013_12_13.pdf http://www.osvdb.org/101714 http://www.osvdb.org/101715 http://www.securityfocus.com/archive/1/530681/100/0/threaded http://www.securityfocus.com/bid/64676 http://www.securitytracker.com/id/1029554 https://exchange.xforce.ibmcloud.com/vulnerabilities/90113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2013-6242

https://notcve.org/view.php?id=CVE-2013-6242

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions. Una vulnerabilidad de tipo cross-site scripting (XSS) en el front-end en Open-Xchange (OX) AppSuite versiones 6.22.3 anteriores a la versión 6.22.3-rev5 y versiones 6.22.4 anteriores a la versión 6.22.4-rev12, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del asunto de un correo electrónico. NOTA: las vulnerabilidades relacionadas con el cuerpo del correo electrónico y el nombre de la publicación fueron SEPARADAS de este ID de CVE porque afectan a diferentes conjuntos de versiones. • http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html http://seclists.org/bugtraq/2013/Nov/127 http://www.securitytracker.com/id/1029394 https://exchange.xforce.ibmcloud.com/vulnerabilities/89250 https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0

CVE-2013-6241

https://notcve.org/view.php?id=CVE-2013-6241

The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id sharing scenarios, does not properly construct a SQL statement for next-year birthdays, which allows remote authenticated users to obtain sensitive birthday, displayname, firstname, and surname information via a birthdays action to api/contacts, aka bug 29315. El widget de Cumpleaños en el 'backend' en Open-Xchange (OX) AppSuite 7.2.x anterior a 7.2.2-rev25 y 7.4.x anterior a 7.4.0-rev14, en algunos casos de compartición de identidad de usuario, no construye adecuadamente una sentencia SQL para los cumpleaños del año siguiente, lo que permite a usuarios remotos autenticados obtener información sensible de cumpleaños, información del nombre a mostrar, nombre, y apellidos a través de la acción cumpleaños en api/contacts, también conocido como bug 29315 • http://archives.neohapsis.com/archives/bugtraq/2013-11/0025.html https://forum.open-xchange.com/showthread.php?8059-Open-Xchange-releases-Security-Patch-2013-10-21-for-v7-2-2-and-v7-4-0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2013-6074

https://notcve.org/view.php?id=CVE-2013-6074

Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file. Vulnerabilidad de XSS en Open-Xchange (OX) AppSuite 7.2.x anterior a la versión 7.2.2-rev25 y 7.4.x anterior a 7.4.0-rev14 permite a atacantes remotos inyectar script web o HTML arbitrario a través de un archivo SVG adjunto. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0025.html http://osvdb.org/99487 http://packetstormsecurity.com/files/123934/Open-Xchange-AppSuite-Script-Insertion.html http://secunia.com/advisories/55575 https://exchange.xforce.ibmcloud.com/vulnerabilities/88609 https://forum.open-xchange.com/showthread.php?8059-Open-Xchange-releases-Security-Patch-2013-10-21-for-v7-2-2-and-v7-4-0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0

CVE-2013-6009

https://notcve.org/view.php?id=CVE-2013-6009

CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet. Vulnerabilidad de inyección CRLF en Open-Xchange AppSuite anterior a la versión 7.2.2, cuando se usa AJP en ciertas condiciones, permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de respuestas HTTP a través del servlet ajax/defer. • http://www.securityfocus.com/archive/1/528940 • CWE-94: Improper Control of Generation of Code ('Code Injection') •