CVE-2021-26608

The provided records describe CVE-2021-26608 as an arbitrary file download and execution vulnerability in Handysoft Co., Ltd groupware ActiveX module, specifically the HShell.dll. Root cause: lack of integrity checking for the download URL or the downloaded file hash. Impact stated as allows arbi...

Japan Total System GroupSession 输入验证错误漏洞

Japan Total System GroupSession is a groupware project from Japan Total System, Inc. that facilitates business and organizational communication and is designed to promote information sharing. An input validation error vulnerability exists in Total System GroupSession that could allow a remote...

Nextcloud: Nextcloud deck sharee search leaks searches to lookupserver by default

So, in short this is related to the other 2 reports https://hackerone.com/reports/1167916 and https://hackerone.com/reports/1167919 While I could not find deck on your h1 page. I kind of assume it is in scope as well as this is something you sell with the 'groupware' subscription...

Horde Groupware Webmail 5.2.22 Cross Site Scripting

Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS Author: Alex Birnberg Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty Date: 04.14.2021 Vendor: https://www.horde.org/apps/webmail Link: https://github.com/horde/webmail/releases CVE: CVE-2021-26929 + Exploit Source:...

Horde Groupware Webmail 5.2.22 - Stored XSS

Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS Author: Alex Birnberg Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty Date: 04.14.2021 Vendor: https://www.horde.org/apps/webmail Link: https://github.com/horde/webmail/releases CVE: CVE-2021-26929 + Exploit Source:...

Kopano Groupware Core Denial of Service Vulnerability

Kopano Groupware Core is an application from the Dutch company Kopano. Provides Groupware features for Kopano stacks and in most cases they are the core of every Kopano environment. A denial of service vulnerability exists in Kopano Groupware Core, which can be exploited by an attacker to exhaust...

CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

Design/Logic Flaw

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

UBUNTU-CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

CVE-2021-28994

kopano-ical formerly zarafa-ical in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers...

CVE-2021-28994

Removed by vendor...

Kopano Groupware Core 资源管理错误漏洞

Kopano Groupware Core is an application from the Dutch company Kopano. Provides Groupware features for Kopano stacks and in most cases they are the core of every Kopano environment. A denial of service vulnerability exists in Kopano Groupware Core, which can be exploited by an attacker to exhaust...

CVE-2020-7850

NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection...

CVE-2020-7850 Douzone ActiveX File Download and Execution Vulnerability

NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection...

CVE-2020-7850

The CVE-2020-7850 entry concerns the NBBDownloader.ocx ActiveX control in Groupware. Descriptions across sources indicate a vulnerability that allows remote files to be downloaded and executed by manipulating arguments to the ActiveX method, enabling a remote attacker to lure a user to a crafted ...

Horde Groupware Webmail Cross-Site Scripting Vulnerability (CNVD-2021-14154)

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A cross-site scripting vulnerability exists in Horde Groupware Webmail Edition, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Debian DLA-2564-1 : php-horde-text-filter security update

Alex Birnberg discovered a cross-site scripting XSS vulnerability in the Horde Application Framework, more precisely its Text Filter API. An attacker could take control of a user's mailbox by sending a crafted e-mail. CVE-2021-26929 An XSS issue was discovered in Horde Groupware Webmail Edition...