Open Xchange Appsuite
Approved changes feed: RSS · Atom
cpe:2.3:a:open-xchange:open-xchange_appsuite:*:rev4:*:*:*:*:*:*
part: a version: * update: rev4
| Vendor | Open Xchange (85b486f1-55be-55d2-8b83-a25950d10c23) |
|---|---|
| Product | Open Xchange Appsuite (5c4f7579-8692-5eac-881b-9aff46aef717) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2016-6852 |
vulnerable | 2026-06-08 05:08:11.203867 |
Details available
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give hints about whether the provided file exists or not. Attackers may discover specific system files or library versions on the middleware server to prepare further attacks.
Published: 2016-12-15T06:31:00.000Z
Updated: 2024-08-06T01:43:38.420Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6850 |
vulnerable | 2026-06-08 05:08:11.201346 |
Details available
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Published: 2016-12-15T06:31:00.000Z
Updated: 2024-08-06T01:43:37.927Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6848 |
vulnerable | 2026-06-08 05:08:11.201025 |
Details available
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution.
Published: 2016-12-15T06:31:00.000Z
Updated: 2024-08-06T01:43:38.439Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6847 |
vulnerable | 2026-06-08 05:08:11.200682 |
Details available
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Published: 2016-12-15T06:31:00.000Z
Updated: 2024-08-06T01:43:37.919Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6845 |
vulnerable | 2026-06-08 05:08:11.193213 |
Details available
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when using base64 encoded "data" resources. This allows an attacker to provide hyperlinks that may execute script code instead of directing to a proper location. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Published: 2016-12-15T06:31:00.000Z
Updated: 2024-08-06T01:43:37.855Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6844 |
vulnerable | 2026-06-08 05:08:11.192890 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6843 |
vulnerable | 2026-06-08 05:08:11.192556 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6842 |
vulnerable | 2026-06-08 05:08:11.192138 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5740 |
vulnerable | 2026-06-08 05:07:57.643355 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.