CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2022-26562
https://notcve.org/view.php?id=CVE-2022-26562
An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa >= 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final). Un problema en el archivo provider/libserver/ECKrbAuth.cpp de Kopano-Core versión v11.0.2.51, contiene un problema que permite a atacantes autenticarse incluso si la cuenta de usuario o la contraseña han caducado • https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-342b96903b https://bugzilla.redhat.com/show_bug.cgi?id=2192126 https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137 https://jira.kopano.io/browse/KC-2021 https://kopano.com https://lists.debian.org/debian-lts-announce/2023/03/msg00006.html https://src.fedoraproject.org/rpms/zarafa/c/a5a8366ccf07f248fae6edffb5123cfda579bfdb?branch=epel7 https://stash.kopano.io/projects/KC/repos/kopanocore/browse/provider • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2021-28994
https://notcve.org/view.php?id=CVE-2021-28994
kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers. kopano-ical (anteriormente zarafa-ical) en Kopano Groupware Core versión hasta 8.7.16, 9.x hasta 9.1.0, 10.x hasta 10.0.7, y 11.xa hasta11.0.1 y Zarafa 6.30.x hasta 7.2.x, permite el agotamiento de la memoria a través de encabezados HTTP largos. • http://www.openwall.com/lists/oss-security/2021/04/01/1 http://www.openwall.com/lists/oss-security/2021/04/25/1 https://www.openwall.com/lists/oss-security/2021/03/19/6 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19907
https://notcve.org/view.php?id=CVE-2019-19907
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data. La función HrAddFBBlock en el archivo libfreebusy/freebusyutil.cpp en Kopano Groupware Core versiones anteriores a 8.7.7, permite un acceso fuera de límites, como es demostrado por el manejo inapropiado de una copia de matriz durante el análisis de datos ICal. • https://lists.debian.org/debian-lts-announce/2023/03/msg00006.html https://stash.kopano.io/projects/KC/repos/kopanocore/browse/RELNOTES.txt https://stash.kopano.io/projects/KC/repos/kopanocore/commits/4e02b420fff • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11666
https://notcve.org/view.php?id=CVE-2017-11666
Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a specially crafted previewable file. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo js/ViewerPanel.js en el plugin file previewer en Kopano WebApp versiones 3.3.0 y anteriores, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de un archivo de vista previa especialmente creado. • https://stash.kopano.io/projects/KWA/repos/filepreviewer/commits/85d2b5c2d27f461bba12e9491fcc4b0d8fde771a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •