CVSS: 5.0EPSS: 1%CPEs: 32EXPL: 1CVE-2010-4715 – Novell Groupwise 8.0 - Multiple Remote Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-4715
Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de salto de directorio en, cuando está habilitado register_globals, permite a atacantes remotos incluir y ejecutar ficheros locales de su elección ,utilizando vectores no especificados. NOTA: algunos de estos detalles se han obtenido de información de terceros. • https://www.exploit-db.com/exploits/34980 http://secunia.com/advisories/40820 http://www.facebook.com/note.php?note_id=477865030928 http://www.novell.com/support/viewContent.do?externalId=7007156&sliceId=1 https://bugzilla.novell.com/show_bug.cgi?id=638644 https://bugzilla.novell.com/show_bug.cgi?id=638646 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 32EXPL: 0CVE-2010-4716
https://notcve.org/view.php?id=CVE-2010-4716
Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el componente WebPublisher de Novell GroupWise en versiones anteriores a v8.02HP, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros no especificados. • http://www.facebook.com/note.php?note_id=477865030928 http://www.novell.com/support/viewContent.do?externalId=7007158&sliceId=1 https://bugzilla.novell.com/show_bug.cgi?id=651159 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 30%CPEs: 32EXPL: 2CVE-2010-4717 – Novell Groupwise Internet Agent - IMAP 'LIST LSUB' Remote Code Execution
https://notcve.org/view.php?id=CVE-2010-4717
Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command. Múltiples desbordamientos de búfer basados en pila en el componente del servidor de IMAP en GroupWise Internet Agent (GWIA) en Novell GroupWise before v8.02HP permite a atacantes remotos ejecutar código de su elección a través de una (1)LIST larga o (2) un comando LSUB. • https://www.exploit-db.com/exploits/15464 http://www.facebook.com/note.php?note_id=477865030928 http://www.novell.com/support/viewContent.do?externalId=7007157&sliceId=1 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=19&Itemid=19 https://bugzilla.novell.com/show_bug.cgi?id=635294 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 83%CPEs: 32EXPL: 0CVE-2010-4325 – Novell Groupwise iCal COMMENT, RRULE, TZNAME Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-4325
Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message. Desbordamiento de búfer en gwwww1.dll en GroupWise Internet Agent (GWIA) en Novell GroupWise anterior a v8.02HP2 permite a atacantes remotos ejecutar código arbitrario a través de una variable TZID manipulada en un mensaje VCALENDAR. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability. Multiple flaws exist within the gwwww1.dll module responsible for parsing VCALENDAR data within e-mail messages. When encountering a RRULE, COMMENT, or TZNAME parameter a static sized memory buffer is allocated. • http://osvdb.org/70676 http://secunia.com/advisories/43089 http://www.novell.com/support/viewContent.do?externalId=7007638&sliceId=1 http://www.novell.com/support/viewContent.do?externalId=7009212 http://www.securityfocus.com/archive/1/516002/100/0/threaded http://www.securityfocus.com/bid/46025 http://www.vupen.com/english/advisories/2011/0220 http://www.zerodayinitiative.com/advisories/ZDI-11-027 https://bugzilla.novell.com/show_bug.cgi?id=657818 https://bugzilla.novell.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 74%CPEs: 32EXPL: 0CVE-2010-4326 – Novell GroupWise Internet Agent REQUEST-STATUS Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-4326
Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, or (4) RRULE variable in this message. Múltiples desbordamientos de búfer en gwwww1.dll en GroupWise Internet Agent de (GWIA) en Novell GroupWise anteriores a v8.02HP permite a atacantes remotos ejecutar código arbitrario a través de las variables en un mensaje VCALENDAR, como lo demuestra con variables largas (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, o (4) RRULE en este mensaje. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gwwww1.dll module responsible for parsing VCALENDAR data within e-mail messages. When the code encounters a REQUEST-STATUS variable it allocates up to 0xFFFF bytes for the variable's value. • http://www.facebook.com/note.php?note_id=477865030928 http://www.novell.com/support/viewContent.do?externalId=7007155&sliceId=1 http://www.securityfocus.com/bid/45994 http://www.vupen.com/english/advisories/2011/0219 http://www.zerodayinitiative.com/advisories/ZDI-11-025 http://zerodayinitiative.com/advisories/ZDI-10-239 http://zerodayinitiative.com/advisories/ZDI-10-240 http://zerodayinitiative.com/advisories/ZDI-10-243 https://bugzilla.novell.com/show_bug.cgi?id=642339 https://bugzil • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •