Design/Logic Flaw

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

CVE-2019-14466 – GOsa vulnerability in GOsa 2.7.5.2 The GOsa_Filter_Settings cookie is vulnerable to PHP object/injection via unserialize, allowing a remote authenticated attacker to perform file deletions in the context of the web server user by crafting the cookie value. The affected component ...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

Debian DLA-1905-1 : gosa security update

GOsa² used unserialize to restore filter settings from a cookie. Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa² up to a potential PHP object injection. For Debian 8 'Jessie', this problem has been...

GOsa Command Execution Vulnerability

GOsa is an LDAP manager. This product is mainly used to manage users and groups, applications, phones and faxes. A security vulnerability exists in GOsa. An attacker can exploit this vulnerability to execute arbitrary code/commands...

Debian: Security Advisory (DLA-1905-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1905-1] gosa security update

Package : gosa Version : 2.7.4+reloaded2-1+deb8u5 CVE ID : CVE-2019-14466 GOsa² used unserialize to restore filter settings from a cookie. Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa² up to a potential PH...

DLA-1905-1 gosa - security update

Bulletin has no description...

GONICUS GOsa Change Password Cross-Site Scripting (CVE-2018-10005)

A cross-site scripting vulnerability exists in GOsa. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the effected system...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

DEBIAN-CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

UBUNTU-CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

Improper access control

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

CVE-2019-11187 concerns the GOsa LDAP class in GONICUS GOsa up to 2019-04-11, where an incorrect access-control flaw can allow login to any account whose username contains the case-insensitive substring “success” when an arbitrary password is provided. The issue is described as an authorization b...

GOsa Incorrect Access Control Vulnerability

GOsa is an LDAP manager. The product is mainly used for system administration to manage users and groups, applications, phones and faxes. A security vulnerability exists in GOsa. An attacker could exploit this vulnerability to gain unauthorized access to the LDAP database...