UBUNTU-CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

CVE-2019-14466 – GOsa vulnerability in GOsa 2.7.5.2 The GOsa_Filter_Settings cookie is vulnerable to PHP object/injection via unserialize, allowing a remote authenticated attacker to perform file deletions in the context of the web server user by crafting the cookie value. The affected component ...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466: Deserialization of Untrusted Data

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

GOsa Command Execution Vulnerability

GOsa is an LDAP manager. This product is mainly used to manage users and groups, applications, phones and faxes. A security vulnerability exists in GOsa. An attacker can exploit this vulnerability to execute arbitrary code/commands...

Debian DLA-1905-1 : gosa security update

GOsa² used unserialize to restore filter settings from a cookie. Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa² up to a potential PHP object injection. For Debian 8 'Jessie', this problem has been...

Debian: Security Advisory (DLA-1905-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1905-1] gosa security update

Package : gosa Version : 2.7.4+reloaded2-1+deb8u5 CVE ID : CVE-2019-14466 GOsa² used unserialize to restore filter settings from a cookie. Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa² up to a potential PH...

PT-2019-13710

Name of the Vulnerable Software and Affected Versions GONICUS GOsa version 2.7.5.2 Description The issue allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server. This is achieved via a crafted cookie value, specifically exploiti...

DLA-1905-1 gosa - security update

Bulletin has no description...

GONICUS GOsa Change Password Cross-Site Scripting (CVE-2018-10005)

A cross-site scripting vulnerability exists in GOsa. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the effected system...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

DEBIAN-CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

Improper access control

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

UBUNTU-CVE-2019-11187

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided...

CVE-2019-11187

CVE-2019-11187 concerns the GOsa LDAP class in GONICUS GOsa up to 2019-04-11, where an incorrect access-control flaw can allow login to any account whose username contains the case-insensitive substring “success” when an arbitrary password is provided. The issue is described as an authorization b...