CVE-2018-1000528

CVE-2018-1000528 affects GONICUS GOsa prior to commit 56070d6289d47ba3f5918885954dcceb75606001. The XSS flaw is in the change password form (html/password.php, #308), allowing injection of arbitrary script/HTML when a user views a specially crafted page. Attack requires victim interaction (openin...

CVE-2018-1000528

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting XSS vulnerability in change password form html/password.php, 308 that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open ...

GOsa Arbitrary Command Execution Vulnerability

GOsa is a set of LDAP front-end tools for managing users. A security vulnerability exists in the 'generatesmbnthash' function in the include/functions.inc file in GOsa. A remote attacker can exploit this vulnerability to execute arbitrary commands with the help of a specially crafted password...

GOsa Cross-Site Scripting Vulnerability

GOsa is a set of LDAP front-end tools for managing users. A cross-site scripting vulnerability exists in the 'displayLogin' function of the html/index.php file in GOsa. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of a username...

Cross site scripting

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

DEBIAN-CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

UBUNTU-CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

DEBIAN-CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2014-9760

Cross-site scripting XSS vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2015-8771

CVE-2015-8771 affects GOsa: the generate_smb_nt_hash function in include/functions.inc allows a remote attacker to execute arbitrary commands via a crafted password. Multiple connected sources (CNVD, OSS/OSV equivalents, Debian advisories, and NVD entry) corroborate the same issue. The vulnerabil...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2014-9760

GOsa contains a cross-site scripting (XSS) vulnerability in the displayLogin function (html/index.php). The vulnerability allows remote attackers to inject arbitrary web script or HTML via the username parameter. The available documents do not specify affected versions, root cause beyond the inpu...

Debian DLA-562-1 : gosa security update

GOsa² is a combination of system-administrator and end-user web interface, designed to handle LDAP based setups. A code injection vulnerability in the Samba plugin code of GOsa has been discovered. During Samba password changes it has been possible to inject malicious Perl code. If you upgrade...