CVE-2016-4047

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed.

• CWE-200
• CWE-611

• http://www.securityfocus.com/archive/1/538732/100/0/threaded
• http://www.securitytracker.com/id/1036157Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/538732/100/0/threaded
• http://www.securitytracker.com/id/1036157Third Party Advisory, VDB Entry

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4040SQL injection vulnerability in the Workflow Screen in dotCMS…
• CVE-2016-4041Plone 4.0 through 5.1a1 does not have security declarations …
• CVE-2016-4042Plone 3.3 through 5.1a1 allows remote attackers to obtain in…
• CVE-2016-4043Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows rem…
• CVE-2016-4045An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-4046An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-4048An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-4049The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quag…
• CVE-2016-4050Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-4051Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5…
• CVE-2016-4052Multiple stack-based buffer overflows in Squid 3.x before 3.…
• CVE-2016-4053Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote at…