CVSS: 6.1EPSS: 1%CPEs: 5EXPL: 0CVE-2016-5760 – Micro Focus GroupWise Cross Site Scripting / Overflows
https://notcve.org/view.php?id=CVE-2016-5760
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp. Múltiples vulnerabilidades XSS en la consola de administrador en Novell GroupWise en versiones anteriores a 2014 R2 Service Pack 1 Hot Patch 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) parámetro de token a gwadmin-console/install/login.jsp o (2) PATH_INFO a gwadmin-console/index.jsp. Micro Focus GroupWise version 2014 R2 SP1 and below suffer from buffer overflow, cross site scripting, and integer overflow vulnerabilities. • http://packetstormsecurity.com/files/138503/Micro-Focus-GroupWise-Cross-Site-Scripting-Overflows.html http://seclists.org/fulldisclosure/2016/Aug/123 http://www.securityfocus.com/archive/1/539296/100/0/threaded http://www.securityfocus.com/bid/92646 https://www.novell.com/support/kb/doc.php?id=7017973 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20160825-0_Micro_Focus_GroupWise_Multiple_vulnerabilities_v10.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 4%CPEs: 2EXPL: 0CVE-2014-0611
https://notcve.org/view.php?id=CVE-2014-0611
Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en WebAccess en Novell GroupWise 2012 anterior a Support Pack 4 y anterior a Support Pack 2 de 2014. Permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.novell.com/support/kb/doc.php?id=7016653 http://www.securitytracker.com/id/1032978 https://bugzilla.novell.com/show_bug.cgi?id=909584 https://bugzilla.novell.com/show_bug.cgi?id=909586 https://bugzilla.novell.com/show_bug.cgi?id=909587 https://bugzilla.novell.com/show_bug.cgi? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 9%CPEs: 19EXPL: 0CVE-2014-0610
https://notcve.org/view.php?id=CVE-2014-0610
The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors. El cliente en Novell GroupWise anterior a 8.0.3 HP4, 2012 anterior a SP3, y 2014 anterior a SP1 en Windows permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (referencia a puntero inválido) a través de vectores no especificados. • http://www.novell.com/support/kb/doc.php?id=7015565 http://www.securitytracker.com/id/1030802 https://bugzilla.novell.com/show_bug.cgi?id=874533 https://exchange.xforce.ibmcloud.com/vulnerabilities/95738 •
CVSS: 7.8EPSS: 65%CPEs: 1EXPL: 0CVE-2014-0600 – Novell Groupwise Administration Server FileUploadServlet poLibMaintenanceFileSave Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-0600
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287. FileUploadServlet en el servicio de administración en Novell GroupWise 2014 anterior a SP1 permite a atacantes remotos leer o escribir ficheros arbitrarios a través del parámetro poLibMaintenanceFileSave, también conocido como ZDI-CAN-2287. This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of the poLibMaintenanceFileSave parameter within the FileUploadServlet. By abusing this flaw an attacker can disclose and destroy arbitrary files on the server and possibly leverage this information to achieve remote code execution in a subsequent attack. • http://www.novell.com/support/kb/doc.php?id=7015566 http://www.securitytracker.com/id/1030801 http://www.zerodayinitiative.com/advisories/ZDI-14-296 https://bugzilla.novell.com/show_bug.cgi?id=879192 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2013-1087
https://notcve.org/view.php?id=CVE-2013-1087
Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message. Vulnerabilidad de XSS en el cliente en Novell GroupWise hasta la 8.0.3 HP3, y 2012 hasta el SP2 sobre Windows, permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML arbitrarias a través del cuerpo de un mensaje de correo electrónico. • http://www.novell.com/support/kb/doc.php?id=7012063 https://bugzilla.novell.com/show_bug.cgi?id=799673 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •