CVE-2013-6242

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.

• CWE-79

• https://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2013/Nov/127Mailing List, Third Party Advisory
• https://www.securitytracker.com/id/1029394Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89250Third Party Advisory, VDB Entry
• https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6Vendor Advisory
• https://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2013/Nov/127Mailing List, Third Party Advisory
• https://www.securitytracker.com/id/1029394Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89250Third Party Advisory, VDB Entry
• https://forum.open-xchange.com/showthread.php?8115-Open-Xchange-releases-Security-Patch-2013-11-12-for-v7-2-2-v6-22-3-and-v7-4-0-v6Vendor Advisory

Published

Jan 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6234Unrestricted file upload vulnerability in the Worksheet desi…8
• CVE-2013-6235Multiple cross-site scripting (XSS) vulnerabilities in JAMon…
• CVE-2013-6236IZON IP 2.0.2: hard-coded password vulnerability9.8
• CVE-2013-6237The ISL Desktop plugin for Windows before 1.4.7 for ISL Ligh…
• CVE-2013-6239Cross-site scripting (XSS) vulnerability in the photo galler…6.1
• CVE-2013-6241The Birthday widget in the backend in Open-Xchange (OX) AppS…
• CVE-2013-6243SQL injection vulnerability in the Landing Pages plugin 1.2.…
• CVE-2013-6244The Live Update webdynpro application (webdynpro/dispatcher/…
• CVE-2013-6245Unspecified vulnerability in SAP Sybase Adaptive Server Ente…
• CVE-2013-6246The Dell Quest One Password Manager, possibly 5.0, allows re…
• CVE-2013-6247Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-6248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…