CVSS: 10.0EPSS: 93%CPEs: 7EXPL: 1CVE-2009-0410 – Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-0410
Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow. Error Off-by-one en el demonio SMTP en GroupWise Internet Agent (GWIA) en Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, y 8.0 que permite a los atacantes remotos ejecutar arbitrariamente código a través de una dirección larga de e-mail en un comando malformado RCPT, conduciendo a un desbordamiento de búfer. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Netware Groupwise SMTP daemon. Authentication is not required to exploit this vulnerability. The specific flaw exists during the parsing of malformed RCPT verb arguments to the SMTP daemon. When an overly long e-mail address is received an off-by-one condition is triggered which minimally will cause a denial of service and can result in arbitrary code execution. • https://www.exploit-db.com/exploits/7985 http://download.novell.com/Download?buildid=GjZRRdqCFW0 http://secunia.com/advisories/33744 http://www.novell.com/support/viewContent.do?externalId=7002502 http://www.securityfocus.com/archive/1/500609/100/0/threaded http://www.securityfocus.com/bid/33560 http://www.zerodayinitiative.com/advisories/ZDI-09-010 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0273
https://notcve.org/view.php?id=CVE-2009-0273
Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML e-mail and (4) HTML attachments. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en WebAccess de GroupWise de Novell v6.5x, v7.0, v7.01, v7.02x, v7.03, v7.03HP1a y v8.0. Permite a atacantes remotos inyectar web script o HTML de su elección a través de los parámetros "User.id" y "Library.queryText" de gw/webacc y a través de otros vectores de ataque relacionados con el e-mail HTML y adjuntos HTML. • http://secunia.com/advisories/33744 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002320 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002321 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-22 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-23 http://www.securityfocus.com/archive/1/500572/100/0/threaded http://www.securityfocus.com/archive/1/500575/100/0/threaded http://www.securityfocus.com/bid/33537 http:&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2009-0272
https://notcve.org/view.php?id=CVE-2009-0272
Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors. Una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Novell GroupWise WebAccess 6.5X, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, y 8.0 permite a atacantes remotos insertar reglas de correo y modificar otros ajustes de configuración de usuarios aleatorios a través de vectores desconocidos. • http://secunia.com/advisories/33744 http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002319 http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21 http://www.securityfocus.com/archive/1/500569/100/0/threaded • CWE-352: Cross-Site Request Forgery (CSRF) •