Teamdavid

UNC path injection in Tobit TeamDavid's Webbox link-storing endpoint (`//ServerClient_celink.htm`) forces the server to initiate outbound SMB connections to attacker-controlled hosts, leaking NTLM authentication credentials and enabling SMB relay attacks against internal systems. The unvalidated `pathname` parameter accepts arbitrary UNC paths (e.g., `\\attacker\share`), triggering Windows credential-passing behavior that exposes the server's NTLM hash. No public exploit code identified at time of analysis, though the underlying NTLM coercion technique is well-understood and documented as part of a broader audit of 22 CVEs in the David platform published by InfoGuard.

Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side password files - via direct filesystem access or through the companion 'Random File Read' vulnerability - to reverse the obfuscation applied to locally-created user passwords and recover plaintext credentials. All TeamDavid deployments through Rollout 524 using locally created accounts are affected, making this a critical identity compromise risk for organizations relying on TeamDavid as an M365 alternative. No public exploit has been independently confirmed, but InfoGuard Labs published a 22-CVE research campaign against this product that likely includes technical detail enabling exploitation.

Stored cross-site scripting in Tobit Laboratories AG TeamDavid's Webbox email interface allows any network-reachable attacker to embed malicious JavaScript within an email body; the payload executes in the browser context of any Webbox user who opens the message. All TeamDavid versions through Rollout 524 are affected per NCSC.ch disclosure and NVD CPE data. No public exploit identified at time of analysis and no CISA KEV confirmation, though the attack technique is trivial and requires no authentication from the sender.

Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the `EntryInfo` query parameter, and the `!templateName=entryMail` parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.

Open redirect in the Webbox component of TeamDavid (Tobit Laboratories AG's Microsoft 365 alternative) enables unauthenticated network attackers to craft URLs on the trusted TeamDavid domain that silently redirect visiting users to arbitrary external sites by supplying an unsanitized value in the 'replyUrl' parameter. All versions through Rollout 524 are affected per the CPE listing. This issue was disclosed as part of a coordinated report of 22 CVEs in the David platform by InfoGuard and reported to NCSC.ch; no confirmed active exploitation or public exploit code has been identified at time of analysis.

HTTP header injection in Tobit Laboratories AG TeamDavid's Webbox component allows unauthenticated network attackers to manipulate HTTP response headers by embedding URL-encoded newline characters via the unsanitized 'cType' URL parameter, enabling open redirect attacks and potential HTTP response splitting. All Webbox deployments through Rollout 524 are affected, as catalogued by NCSC.ch and detailed in InfoGuard's research covering 22 CVEs in the TeamDavid platform. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects medium severity gated by required user interaction.

Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenticated attacker to shut down the server by requesting the exposed /internalRestart endpoint, which fully halts the service rather than restarting it. All releases through Rollout 524 are affected, and recovery requires manual administrator intervention to bring the server back online. No public exploit identified at time of analysis, though the trigger is trivial (a single HTTP request to a known path).

Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.

Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.

Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.

Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.

Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.

UNC path injection in TeamDavid Webbox's !ArcEntryMove archive function causes the server to initiate outbound SMB connections to attacker-controlled infrastructure, exposing the server's NTLM authentication material (Net-NTLMv2 hashes). All TeamDavid deployments through Rollout 524 are affected, with the confidentiality impact occurring on subsequent systems - the attacker's SMB listener - rather than the Webbox host itself. No public exploit has been identified at time of analysis, but the attack technique is fully commoditized via tools such as Responder and Impacket; exploitation feasibility is further complicated by a contradictory authentication requirement in the source data that warrants vendor clarification.

UNC path injection in Tobit Laboratories AG TeamDavid's Webbox messaging component allows attackers to coerce the server into initiating outbound SMB connections to attacker-controlled hosts, exposing NTLM authentication credentials. The server processes @@INCLUDE directives containing Windows UNC paths (e.g., \\Server\Share) without validation across email, fax, and SMS composition features. Captured NTLM hashes can be cracked offline or relayed to authenticate against other internal services; the CVE description explicitly states the pathname parameter vector is exploitable without authentication, conflicting with the PR:L designation in the CVSS 4.0 vector. No public exploit or CISA KEV listing has been identified at time of analysis, but this attack class (NTLM coercion via UNC injection) is well-understood and widely tooled.

Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote attackers harvest sensitive server memory - including user passwords - by repeatedly requesting the malformed endpoint "/.well-known/mta-sts.", which causes the application to return raw memory contents in its response. The flaw resembles a Heartbleed-style over-read affecting a self-hosted Microsoft 365 alternative, and no public exploit identified at time of analysis, though it was disclosed as part of a broader research batch (22 CVEs) by InfoGuard Labs and reported via NCSC.ch. With CVSS 4.0 9.2 (Critical), network-reachable and requiring no authentication or user interaction, it is a high-priority disclosure risk wherever David is internet-exposed.

Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.

Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to retrieve sensitive error messages and internal application details without any credentials. All TeamDavid versions through Rollout 524 are affected per CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; this vulnerability was disclosed as part of a batch of 22 CVEs uncovered by InfoGuard researchers during a systematic security audit of the platform.

File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. No public exploit has been identified at time of analysis, though this vulnerability is part of a multi-CVE research disclosure of 22 issues in the David platform by Infoguard.

HTTP header injection in TeamDavid's Webbox component allows unauthenticated remote attackers to inject arbitrary HTTP response headers by embedding line feed (LF) characters in request body data sent to the link storing endpoint (//ServerClient_celink.htm). The injected data is appended unsanitized to the Location header of the 302 redirect response, enabling an attacker to control response headers against any user who interacts with a crafted link. This flaw is one of 22 CVEs disclosed by InfoGuard Labs in the David platform (marketed as a secure M365 alternative); no public exploit code or active exploitation has been identified at time of analysis.

Open redirect and HTTP response header injection in the Webbox component of TeamDavid (by Tobit Laboratories AG) allow unauthenticated network attackers to manipulate 302 redirect responses by supplying encoded characters in user-controlled URL parameters. Using URL-encoded dots (%2e), an attacker can steer victims toward attacker-registered lookalike TLD domains (e.g., redirecting from a .com application to an attacker-owned .company domain), while URL-encoded line feeds enable HTTP response splitting to inject arbitrary headers. No public exploit or CISA KEV listing has been identified at time of analysis; this CVE is one of 22 disclosed against the David product suite by infoguard.ch researchers.

Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.