CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks.

• CWE-200

• http://seclists.org/fulldisclosure/2018/Jul/12Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1041213Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/12Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1041213Third Party Advisory, VDB Entry

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9992Frog CMS 0.9.5 has XSS via the name field of a new "File" or…
• CVE-2018-9993YUNUCMS 1.0.7 has XSS via the content title on an admin/cont…
• CVE-2018-9994Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-9995TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QS…
• CVE-2018-9996An issue was discovered in cplus-dem.c in GNU libiberty, as …
• CVE-2018-9997Cross-site scripting (XSS) vulnerability in mail compose in …
• CVE-2018-9999In Zulip Server versions before 1.7.2, there was an XSS issu…