CVE-2014-5238

XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.

• CWE-611

• http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.htmlThird Party Advisory, VDB Entry
• http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdfRelease Notes, Vendor Advisory
• http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threadedThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.htmlThird Party Advisory, VDB Entry
• http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdfRelease Notes, Vendor Advisory
• http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threadedThird Party Advisory, VDB Entry

Published

Jan 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5232The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for i…
• CVE-2014-5233The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for i…
• CVE-2014-5234Cross-site scripting (XSS) vulnerability in the backend in O…
• CVE-2014-5235Cross-site scripting (XSS) vulnerability in the frontend in …
• CVE-2014-5236Multiple absolute path traversal vulnerabilities in document…7.5
• CVE-2014-5237Server-side request forgery (SSRF) vulnerability in the docu…
• CVE-2014-5239The Microsoft Outlook.com application before 7.8.2.12.49.709…
• CVE-2014-5240Cross-site scripting (XSS) vulnerability in wp-includes/plug…
• CVE-2014-5241The JSONP endpoint in includes/api/ApiFormatJson.php in Medi…
• CVE-2014-5242Cross-site scripting (XSS) vulnerability in mediawiki.page.i…
• CVE-2014-5243MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.…
• CVE-2014-5246The Shenzhen Tenda Technology Tenda A5s router with firmware…