CVSS: 10.0EPSS: 31%CPEs: 11EXPL: 0CVE-2012-0417 – Novell Groupwise GWIA ber_get_stringa Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-0417
Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de entero en GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 permite a atacantes remotos ejecutar código de su elección a través de vectores no especificados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. The flaw exists within the Groupwise Internet Agent component, specifically the optional LDAP server which listens on tcp port 389. When parsing a BER encoded parameter the specified size is used to allocate a destination buffer. • http://download.novell.com/Download?buildid=O5hTjIiMdMo~ http://www.novell.com/support/kb/doc.php?id=7010770 http://www.securitytracker.com/id?1027599 https://bugzilla.novell.com/show_bug.cgi?id=740041 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 96%CPEs: 11EXPL: 0CVE-2012-0419 – Novell Groupwise Agents HTTP Directory Traversal
https://notcve.org/view.php?id=CVE-2012-0419
Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request. Vulnerabilidad de salto de directorio en los interfaces del agente HTTP en Novell GroupWise v8.0 antes de Support Pac, 3 y 2012 antes de Support Pack 1, permite a atacantes remotos leer archivos de su elección a través de secuencias de salto de directorio en una petición. • http://archives.neohapsis.com/archives/bugtraq/2012-09/0106.html http://download.novell.com/Download?buildid=O5hTjIiMdMo~ http://seclists.org/fulldisclosure/2012/Sep/161 http://www.novell.com/support/kb/doc.php?id=7010772 https://bugzilla.novell.com/show_bug.cgi?id=756330 https://bugzilla.novell.com/show_bug.cgi?id=756924 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2012-0272
https://notcve.org/view.php?id=CVE-2012-0272
Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el componente WebAccess en Novell GroupWise v8.0 anterior al Support Pack 3, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro "merge". • http://www.novell.com/support/kb/doc.php?id=7010368 http://www.securitytracker.com/id?1027615 https://bugzilla.novell.com/show_bug.cgi?id=702785 https://bugzilla.novell.com/show_bug.cgi?id=740563 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 11%CPEs: 43EXPL: 2CVE-2012-0271 – Novell Groupwise 8.0.2 HP3 and 2012 - Integer Overflow
https://notcve.org/view.php?id=CVE-2012-0271
Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as demonstrated by a request with -1 in the Content-Length HTTP header. Un desbordamiento de entero en el componente de consola web en gwia.exe en el Agente de Internet de GroupWise (GWIA) en Novell GroupWise v8.0 antes de v8.0.3 HP1 y 2012 antes de SP1 podría permitir a atacantes remotos ejecutar código de su elección a través de una solicitud hecha a mano que dispara un desbordamiento de búfer basado en memoria dinámica (heap), tal y como queda demostrado con una solicitud con un -1 en la cabecera HTTP "Content-Length". • https://www.exploit-db.com/exploits/21326 http://osvdb.org/85426 http://www.novell.com/support/kb/doc.php?id=7010769 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=61&Itemid=61 https://bugzilla.novell.com/show_bug.cgi?id=746199 • CWE-189: Numeric Errors •
CVSS: 4.3EPSS: 45%CPEs: 4EXPL: 0CVE-2011-3827
https://notcve.org/view.php?id=CVE-2011-3827
The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment. El componente iCalendar en gwwww1.dll en GroupWise Internet Agent (GWIA) en Novell GroupWise v8.0 anterior al Support Pack 3, permite a atacantes remotos provocar una denegación de servicio (lectura de memoria fuera de rango o caída de aplicación) a través de una cadena de tiempo (fecha y hora) en un adjunto .ics. • http://archives.neohapsis.com/archives/bugtraq/2012-09/0075.html http://secunia.com/secunia_research/2012-30 http://www.novell.com/support/kb/doc.php?id=7010767 http://www.securitytracker.com/id?1027540 https://bugzilla.novell.com/show_bug.cgi?id=733887 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •