The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user

User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API

Malicious or unintentional API requests can be used to add significant amount of data to caches

Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session

Processing of user-defined mail search expressions is not limited

Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached

Processing of user-defined DAV user-agent strings is not limited

Malicious e-mail content can be used to execute script code

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users…

Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine

User ID references at mentions in document comments were not correctly sanitized

The "upsell" widget at the portal page could be abused to inject arbitrary script code

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links

Malicious content at office documents can be used to inject script code when editing a document

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links

Malicious content from E-Mail can be used to perform a redressing attack

Module savepoints could be abused to inject references to malicious code delivered through the same domain

Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session

Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session

Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session

References to the "app loader" functionality could contain redirects to unexpected locations

User-defined script code could be stored for a upsell related shop URL

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly

E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account