CVE-2009-2354: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the authcheckpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter...

High security hole in NullLogic Groupware

Hi, I've identified a couple of security flaws affecting the NullLogic Groupware which may allow compromise of accounts, denial of service or even remote code execution. These issues were reported by email to the developer but no response was forthcoming. Tim -- Tim Brown...

CVE-2009-1468

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...

Sql injection

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...

CVE-2009-1468

IceWarp eMail Server / WebMail Server prior to version 9.4.2 contains SQL injection vulnerabilities in the webmail groupware search (server/webmail.php). The flaws allow remote authenticated users to manipulate SQL through the sql and order_by elements within an XML search query, enabling arbitra...

[RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component

Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in the IceWarp WebMail Server. Attackers that are in control of a user account for the web-based email and groupware components are able to execut...

CVE-2009-1468: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 sql and 2 orderby elements in an XML search query...

[RT-SA-2009-003] IceWarp WebMail Server: SQL Injection in Groupware Component

Advisory: IceWarp WebMail Server: SQL Injection in Groupware Component During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in the IceWarp WebMail Server. Attackers that are in control of a user account for the web-based email and groupware components are able to execut...

Tiki Wiki CMS Groupware < 2.4 Multiple XSS Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

Cross-site scripting XSS vulnerability in TikiWiki Tiki CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to 1 tiki-galleries.php, 2 tiki-listfilegallery.php, 3 tiki-listpages.php, and 4 tiki-orphanpages.php...

CVE-2009-1204

Cross-site scripting XSS vulnerability in TikiWiki Tiki CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to 1 tiki-galleries.php, 2 tiki-listfilegallery.php, 3 tiki-listpages.php, and 4 tiki-orphanpages.php...

CVE-2009-1204

Tiki Wiki CMS Groupware (Tiki) 2.2 is affected by multiple XSS flaws via the PHP_SELF parameter in tiki-galleries.php, tiki-list_file_gallery.php, tiki-listpages.php, and tiki-orphan_pages.php. The OpenVAS entry also notes vulnerabilities for versions

DSA-1752-1 webcit - potential remote code execution

Bulletin has no description...

CVE-2009-0932

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...

Cross site scripting

Cross-site scripting XSS vulnerability in the tag cloud search script horde/services/portal/cloudsearch.php in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0932

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...

CVE-2009-0931

Cross-site scripting XSS vulnerability in the tag cloud search script horde/services/portal/cloudsearch.php in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0932

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...

CVE-2009-0932: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the HordeImage driver name...

CVE-2009-0931: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the tag cloud search script horde/services/portal/cloudsearch.php in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...