CVE-2016-6851
published 2016-12-15CVE-2016-6851: An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This…
PriorityP338medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.64%
83.7th percentile
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open-xchange | ox_guard | <= 2.4.2 | — |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1.1+deb9u5build0.16.04.1 | 2.1.2-1.1+deb9u5build0.16.04.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-494v-jqp4-m59h: An issue was discovered in Open-Xchange OX Guard before 2
ghsa_unreviewed·2022-05-14
CVE-2016-6851 [MEDIUM] CWE-79 GHSA-494v-jqp4-m59h: An issue was discovered in Open-Xchange OX Guard before 2
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.
OSV
OpenJPEG vulnerabilities
osv·2020-09-15·CVSS 7.5
CVE-2016-9112 OpenJPEG vulnerabilities
OpenJPEG vulnerabilities
It was discovered that OpenJPEG incorrectly handled certain image files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-9112)
It was discovered that OpenJPEG did not properly handle certain input. If
OpenJPEG were supplied with specially crafted input, it could be made to crash
or potentially execute arbitrary code.
(CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389)
It was discovered that OpenJPEG incorrectly handled certain BMP files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2019-12973)
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.htmlhttp://www.securityfocus.com/archive/1/539395/100/0/threadedhttp://www.securityfocus.com/bid/92920https://www.exploit-db.com/exploits/40377/http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.htmlhttp://www.securityfocus.com/archive/1/539395/100/0/threadedhttp://www.securityfocus.com/bid/92920https://www.exploit-db.com/exploits/40377/
2016-12-15
Published