CVE-2016-6842

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).

• CWE-79

• http://www.securityfocus.com/bid/93457Third Party Advisory, VDB Entry
• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/93457Third Party Advisory, VDB Entry
• https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3522_7.8.2_2016-08-29.pdfRelease Notes, Vendor Advisory

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6835The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx…6
• CVE-2016-6836The vmxnet3_complete_packet function in hw/net/vmxnet3.c in …6
• CVE-2016-6837Cross-site scripting (XSS) vulnerability in MantisBT Filter …
• CVE-2016-6838Huawei X6800 and XH620 V3 servers with software before V100R…
• CVE-2016-6839CRLF injection vulnerability in Huawei FusionAccess before V…
• CVE-2016-6840Cross-site scripting (XSS) vulnerability in the management i…
• CVE-2016-6843An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6844An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6845An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6846Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…
• CVE-2016-6847An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6848An issue was discovered in Open-Xchange OX App Suite before …