CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0272
https://notcve.org/view.php?id=CVE-2009-0272
Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors. Una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Novell GroupWise WebAccess 6.5X, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, y 8.0 permite a atacantes remotos insertar reglas de correo y modificar otros ajustes de configuración de usuarios aleatorios a través de vectores desconocidos. • http://secunia.com/advisories/33744 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002319 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21 http://www.securityfocus.com/archive/1/500569/100/0/threaded • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2008-3501
https://notcve.org/view.php?id=CVE-2008-3501
Cross-site scripting (XSS) vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la interfaz simple WebAccess de Novell Groupwise 7.0.x permite a atacantes remotos inyectar web script o HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/30839 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028200.html http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028303.html http://www.securityfocus.com/bid/29922 http://www.securitytracker.com/id?1020359 http://www.vupen.com/english/advisories/2008/1929/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43326 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 11%CPEs: 4EXPL: 1CVE-2008-2069 – Groupwise 7.0 - 'mailto: scheme' Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2008-2069
Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI. Desbordamiento de búfer en Novell GroupWise 7 permite a atacantes remotos provocar una denegación de servicio o la ejecución de código de su elección a través de un un argumento largo en una URI: mailto. • https://www.exploit-db.com/exploits/5515 http://securityreason.com/securityalert/3847 http://www.securityfocus.com/archive/1/491376/100/0/threaded http://www.securityfocus.com/archive/1/491576/100/0/threaded http://www.securityfocus.com/archive/1/491594/100/0/threaded http://www.securityfocus.com/bid/28969 http://www.securitytracker.com/id?1019942 http://www.vupen.com/english/advisories/2008/1393/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42052 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.5EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1330
https://notcve.org/view.php?id=CVE-2008-1330
Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker. Vulnerabilidad sin especificar en Windows client API de Novell GroupWise 7 antes de SP3 y 6.5 antes de SP6 Update 3 permite a usuarios remotamente autentificados acceder a los emails no compartidos almacenados de otro usuario que haya compartido al menos una carpeta con el atacante. • http://secunia.com/advisories/29409 http://securitytracker.com/id?1019616 http://www.securityfocus.com/bid/28265 http://www.vupen.com/english/advisories/2008/0904 https://exchange.xforce.ibmcloud.com/vulnerabilities/41223 https://secure-support.novell.com/KanisaPlatform/Publishing/732/3263374_f.SAL_Public.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 37%CPEs: 1EXPL: 2CVE-2007-6435
https://notcve.org/view.php?id=CVE-2007-6435
Stack-based buffer overflow in Novell GroupWise before 6.5.7, when HTML preview of e-mail is enabled, allows user-assisted remote attackers to execute arbitrary code via a long SRC attribute in an IMG element when forwarding or replying to a crafted e-mail. Desbordamiento de búfer basado en pila en Novell GroupWise anterior a 6.5.7, cuando la vista previa HTML del correo está activada, permite a un atacante remoto con la intervención de un usuario ejecutar código de su elección a través de un atributo SRC largo en una elemento IMG cuando responde o reenvía en un correo manipulado. • http://osvdb.org/40870 http://secunia.com/advisories/28102 http://securityreason.com/securityalert/3459 http://www.infobyte.com.ar/adv/ISR-16.html http://www.securityfocus.com/archive/1/485100/100/0/threaded http://www.securityfocus.com/bid/26875 http://www.securitytracker.com/id?1019101 http://www.vupen.com/english/advisories/2007/4273 https://exchange.xforce.ibmcloud.com/vulnerabilities/39032 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •