CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0273
https://notcve.org/view.php?id=CVE-2009-0273
Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML e-mail and (4) HTML attachments. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en WebAccess de GroupWise de Novell v6.5x, v7.0, v7.01, v7.02x, v7.03, v7.03HP1a y v8.0. Permite a atacantes remotos inyectar web script o HTML de su elección a través de los parámetros "User.id" y "Library.queryText" de gw/webacc y a través de otros vectores de ataque relacionados con el e-mail HTML y adjuntos HTML. • http://secunia.com/advisories/33744 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002320 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002321 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-22 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-23 http://www.securityfocus.com/archive/1/500572/100/0/threaded http://www.securityfocus.com/archive/1/500575/100/0/threaded http://www.securityfocus.com/bid/33537 http:&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0272
https://notcve.org/view.php?id=CVE-2009-0272
Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors. Una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Novell GroupWise WebAccess 6.5X, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, y 8.0 permite a atacantes remotos insertar reglas de correo y modificar otros ajustes de configuración de usuarios aleatorios a través de vectores desconocidos. • http://secunia.com/advisories/33744 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002319 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21 http://www.securityfocus.com/archive/1/500569/100/0/threaded • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2008-3501
https://notcve.org/view.php?id=CVE-2008-3501
Cross-site scripting (XSS) vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la interfaz simple WebAccess de Novell Groupwise 7.0.x permite a atacantes remotos inyectar web script o HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/30839 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028200.html http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028303.html http://www.securityfocus.com/bid/29922 http://www.securitytracker.com/id?1020359 http://www.vupen.com/english/advisories/2008/1929/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43326 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1330
https://notcve.org/view.php?id=CVE-2008-1330
Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker. Vulnerabilidad sin especificar en Windows client API de Novell GroupWise 7 antes de SP3 y 6.5 antes de SP6 Update 3 permite a usuarios remotamente autentificados acceder a los emails no compartidos almacenados de otro usuario que haya compartido al menos una carpeta con el atacante. • http://secunia.com/advisories/29409 http://securitytracker.com/id?1019616 http://www.securityfocus.com/bid/28265 http://www.vupen.com/english/advisories/2008/0904 https://exchange.xforce.ibmcloud.com/vulnerabilities/41223 https://secure-support.novell.com/KanisaPlatform/Publishing/732/3263374_f.SAL_Public.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2006-4220 – Novell Groupwise 5.57e/6.5.7/7.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-4220
Multiple cross-site scripting (XSS) vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the (1) User.html, (2) Error, (3) User.Theme.index, and (4) and User.lang parameters. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS)en el webacc de Novell GroupWise WebAccess anterior a la v.7 Support Pack 3 Public Beta, que permite a atacantes remoto inyectar código web o HTML de su elección a través de los parámetros (1) User.html, (2) Error, (3) User.Theme.index, y (4) User.Lang • https://www.exploit-db.com/exploits/31095 http://secunia.com/advisories/28778 http://www.novell.com/documentation/gw7/readmeusgw7sp3/readmeusgw7sp3.html#b4qb42z http://www.osvdb.org/27531 http://www.securityfocus.com/bid/27582 http://www.securitytracker.com/id?1019302 http://www.vupen.com/english/advisories/2008/0395 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •