CVSS: 7.5EPSS: 21%CPEs: 9EXPL: 1CVE-2009-1634 – Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-1634
The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors. El componente WebAccess en Novell GroupWise v7.x anterior a v7.03 HP3 y v8.x anterior a v8.0 HP2 no implementa adecuadamente los mecanismos de manejo de sesión, lo que permite a atacantes remotos conseguir acceso a cuentas de usuario a través de vectores sin especificar. • https://www.exploit-db.com/exploits/33007 http://secunia.com/advisories/35177 http://www.novell.com/support/viewContent.do?externalId=7003266&sliceId=1 http://www.securityfocus.com/bid/35066 http://www.vupen.com/english/advisories/2009/1393 https://bugzilla.novell.com/show_bug.cgi?id=472979 https://exchange.xforce.ibmcloud.com/vulnerabilities/50688 •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2009-1762
https://notcve.org/view.php?id=CVE-2009-1762
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess login page (aka gw/webacc) in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the (1) GWAP.version or (2) User.Theme (aka User.Theme.index) parameter. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la página de acceso WebAccess (también conocido como gw/webacc) en Novell GroupWise v7.x anteriores a v7.03 HP2 , permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de (1) GWAP.version o (2) parámetro User.Theme (también conocido como User.Theme.index). • http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt http://secunia.com/advisories/35177 http://securitytracker.com/id?1022267 http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 http://www.securityfocus.com/archive/1/503700/100/0/threaded http://www.securityfocus.com/bid/35061 http://www.vupen.com/english/advisories/2009/1393 https://bugzilla.novell.com/show_bug.cgi?id=484942 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2009-1635 – Novell Groupwise Cross Site Scripting
https://notcve.org/view.php?id=CVE-2009-1635
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en el componente WebAccess en GroupWise de Novell versiones 7.x anteriores a 7.03 HP3 y versiones 8.x anteriores a 8.0 HP2, permiten a los atacantes remotos inyectar script web o HTML arbitrarios por medio de (1) el parámetro User.lang en la página de inicio de sesión (también se conoce como gw/webacc), (2) expresiones de estilo en un mensaje que contiene un archivo HTML, o (3) vectores asociados con mecanismos de protección incorrectos contra scripting, como es demostrado utilizando espacios en blanco entre los nombres y valores de eventos de JavaScript. Novell Groupwise Web Access suffers from multiple cross site scripting vulnerabilities. • http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt http://secunia.com/advisories/35177 http://securitytracker.com/id?1022267 http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1 http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1 http://www.securityfocus.com/archive/1/503700/100/0/threaded http://www.securityfocus.com/archive/1/503885/100/0/threaded http://ww • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0274
https://notcve.org/view.php?id=CVE-2009-0274
Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests. Vulnerabilidad no especificada en WebAccess en Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, y 8.0 debería permitir a los atacantes remotos obtener información confidencial a través de una URL manipulada, en relación a la conversión de la petición POST a GET. • http://secunia.com/advisories/33744 http://www.novell.com/support/viewContent.do?externalId=7002322 http://www.securityfocus.com/bid/33559 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 93%CPEs: 7EXPL: 1CVE-2009-0410 – Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-0410
Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow. Error Off-by-one en el demonio SMTP en GroupWise Internet Agent (GWIA) en Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, y 8.0 que permite a los atacantes remotos ejecutar arbitrariamente código a través de una dirección larga de e-mail en un comando malformado RCPT, conduciendo a un desbordamiento de búfer. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware Groupwise SMTP daemon. Authentication is not required to exploit this vulnerability. The specific flaw exists during the parsing of malformed RCPT verb arguments to the SMTP daemon. When an overly long e-mail address is received an off-by-one condition is triggered which minimally will cause a denial of service and can result in arbitrary code execution. • https://www.exploit-db.com/exploits/7985 http://download.novell.com/Download?buildid=GjZRRdqCFW0 http://secunia.com/advisories/33744 http://www.novell.com/support/viewContent.do?externalId=7002502 http://www.securityfocus.com/archive/1/500609/100/0/threaded http://www.securityfocus.com/bid/33560 http://www.zerodayinitiative.com/advisories/ZDI-09-010 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •