CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4557
https://notcve.org/view.php?id=CVE-2007-4557
Cross-site scripting (XSS) vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for CVE-2004-2103.2. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en el servlet webacc en Novell GroupWise 6.5 WebAccess permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro User.Id, como se demostró con la URL con una campo de url en un elemento STYLE, posiblemente relacionado con una solución incompleta para CVE-2004-2103.2. • http://0x000000.com/index.php?i=409 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 0CVE-2006-3818
https://notcve.org/view.php?id=CVE-2006-3818
Cross-site scripting (XSS) vulnerability in the login page in Novell GroupWise WebAccess 6.5 before 20060721 and WebAccess 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via the GWAP.version parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página de autenticación de acceso de Novell GroupWise WebAccess 6.5 anterior al 21/07//2006 y WebAccess 7 anterior al 27/07/2006 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro GWAP.version. • http://secunia.com/advisories/21411 http://securitytracker.com/id?1016648 http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974176.htm http://www.securityfocus.com/bid/19297 http://www.vupen.com/english/advisories/2006/3098 https://exchange.xforce.ibmcloud.com/vulnerabilities/28210 https://secure-support.novell.com/KanisaPlatform/Publishing/228/3574517_f.SAL_Public.html •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 3CVE-2006-3817
https://notcve.org/view.php?id=CVE-2006-3817
Cross-site scripting (XSS) vulnerability in Novell GroupWise WebAccess 6.5 and 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via an encoded SCRIPT element in an e-mail message with the UTF-7 character set, as demonstrated by the "+ADw-SCRIPT+AD4-" sequence. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Niovell GroupWise WebAccess 6.5 y 7 anterior al 27/07/2006 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante un elemento SCRIPT codificado en un mensaje de correo electrónico con el juego de caracteres UTF-7, como se ha demostrado con la secuencia "+ADw-SCRIPT+AD4-". • http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048593.html http://secunia.com/advisories/21411 http://securitytracker.com/id?1016648 http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974176.htm http://www.infobyte.com.ar/adv/ISR-14.html http://www.novell.com/support/search.do?cmd=displayKC&externalId=3701584&sliceId=SAL_Public http://www.securityfocus.com/archive/1/442719/100/100/threaded http://www.securityfocus.com/bid/19297 http://www.vupen.com/eng •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 2CVE-2005-2276 – Novell Groupwise 6.5 Webaccess - HTML Injection
https://notcve.org/view.php?id=CVE-2005-2276
Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess 6.5 before July 11, 2005 allows remote attackers to inject arbitrary web script or HTML via an e-mail message with an encoded javascript URI (e.g. "jAvascript" in an IMG tag. Vulnerabilidad de secuencia de comandos en sitios cruzados en Novell Groupwise WebAccess 6.5 anterior a July 11, 2005 permite que atacantes remotos inyecten script web arbitrario o HTML mediante un mensaje de correo con un javascript codificado en un URI (e.g. "jAvascript" en una etiqueta IMG). • https://www.exploit-db.com/exploits/26001 http://marc.info/?l=bugtraq&m=112181451014783&w=2 http://secunia.com/advisories/16098 http://securitytracker.com/id?1014515 http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098301.htm http://www.infobyte.com.ar/adv/ISR-11.html http://www.osvdb.org/18064 http://www.securityfocus.com/bid/14310 https://exchange.xforce.ibmcloud.com/vulnerabilities/21421 •
CVSS: 5.0EPSS: 1%CPEs: 12EXPL: 0CVE-2005-0296
https://notcve.org/view.php?id=CVE-2005-0296
NOTE: this issue has been disputed by the vendor. The error module in Novell GroupWise WebAccess allows remote attackers who have not authenticated to read potentially sensitive information, such as the version, via an incorrect login and a modified (1) error or (2) modify parameter that returns template files or the "about" information page. NOTE: the vendor has disputed this issue • http://marc.info/?l=bugtraq&m=110608203729814&w=2 http://support.novell.com/servlet/tidfinder/10096251 http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2005-01/0771.html http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-01/0341.html http://www.osvdb.org/13135 http://www.securityfocus.com/bid/12285 https://exchange.xforce.ibmcloud.com/vulnerabilities/18954 •