https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 05:37:47 +0000 https://vulnerability.circl.lu/vuln/cnvd-2016-04413 cnvd-2016-04413 https://vulnerability.circl.lu/vuln/cnvd-2016-04413 https://vulnerability.circl.lu/vuln/fkie_cve-2016-4028 <p>An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users&#39; credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user&#39;s &#34;OxReaderID&#34; cookie and the value of the &#34;auth&#34; parameter needs to be known to the attacker.</p> <p>An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users&#39; credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user&#39;s &#34;OxReaderID&#34; cookie and the value of the &#34;auth&#34; parameter needs to be known to the attacker.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2016-4028 https://vulnerability.circl.lu/vuln/ghsa-qxh8-75pv-8vmg <p>An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users&#39; credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user&#39;s &#34;OxReaderID&#34; cookie and the value of the &#34;auth&#34; parameter needs to be known to the attacker.</p> <p>An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users&#39; credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user&#39;s &#34;OxReaderID&#34; cookie and the value of the &#34;auth&#34; parameter needs to be known to the attacker.</p> https://vulnerability.circl.lu/vuln/ghsa-qxh8-75pv-8vmg https://vulnerability.circl.lu/vuln/gsd-2016-4028 gsd-2016-4028 https://vulnerability.circl.lu/vuln/gsd-2016-4028