CVE-2023-26456

Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.

• CWE-79
• CWE-79

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdfRelease Notes, Vendor Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdfRelease Notes, Vendor Advisory

Published

Nov 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26450The "OX Count" web service did not specify a media-type when…5.4
• CVE-2023-26451Functions with insufficient randomness were used to generate…7.5
• CVE-2023-26452Requests to cache an image and return its metadata could be …8.8
• CVE-2023-26453Requests to cache an image could be abused to include SQL qu…8.8
• CVE-2023-26454Requests to fetch image metadata could be abused to include …8.8
• CVE-2023-26455RMI was not requiring authentication when calling ChronosRMI…7.8
• CVE-2023-26457SAP Content Server - version 7.53, does not sufficiently enc…6.1
• CVE-2023-26458An information disclosure vulnerability exists in SAP Landsc…8.7
• CVE-2023-26459Due to improper input controls In SAP NetWeaver AS for ABAP …7.4
• CVE-2023-2646A vulnerability has been found in TP-Link Archer C7v2 v2_en_…4.5
• CVE-2023-26460Cache Management Service in SAP NetWeaver Application Server…5.3
• CVE-2023-26461SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50,…4.9