CVE

Id
93668  
CVE No.
CVE-2016-6848  
Status
Candidate  
Description
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution.  
Phase
Assigned (20160818)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794282 93668 CVE-2016-6848 CONFIRM:https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdf  View
794283 93668 CVE-2016-6848 BID:93460  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
4392 JVNDB-2016-005165 QEMU の xlnx.xps-ethernetlite の .receive コールバックにおけるヒープベースのバッファオーバーフローの脆弱性 QEMU (別名 Quick Emulator) の xlnx.xps-ethernetlite の .receive コールバックには、ヒープベースのバッファオーバーフローの脆弱性が存在します。 CVE-2016-7161 93668 10 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005165.html  View