26 matches found
Novell GroupWise WebAccess 2012 < 2012 SP4 / 2014 < 2014 SP2 Multiple XSS (7016653)
The remote host is running a version of Novell GroupWise WebAccess that is 2012 prior to 2012 SP4 or 2014 prior to 2014 SP2. It is, therefore, affected by multiple cross-site scripting vulnerabilities due to improper validation of user-supplied input. A remote attacker can exploit this, via a...
Novell GroupWise WebAccess 12.0.x < 12.0.4 / 14.0.x < 14.0.2 Multiple XSS Vulnerabilities
The version of Novell GroupWise WebAccess installed on the remote host is affected by multiple unspecified cross-site scripting XSS vulnerabilities that can allow a remote attacker to trick authenticated users into executing arbitrary JavaScript code in the context of the WebAccess session. C...
Novell GroupWise WebAccess Detection
Novell GroupWise WebAccess, a component of the GroupWise suite that provides web-based remote access, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62415; scriptversion"1.7";...
Novell GroupWise WebAccess Arbitrary File Download
The installed version of GroupWise WebAccess fails to perform sufficient validation on a user specified file name supplied via 'filename' parameter before returning the contents of the file. By supplying directory traversal strings such as '../' in a specially crafted 'GET' request, it may be...
Novell GroupWise WebAccess Accessible
The remote web server is a Novell GroupWise WebAccess console. By allowing unauthenticated access to this web server, anyone may be able read status, configuration or log files pertaining to GroupWise WebAccess. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid50693;...
ZDI-10-135: Novell Groupwise WebAccess Multiple Cross-Site Scripting Vulnerabilities
ZDI-10-135: Novell Groupwise WebAccess Multiple Cross-Site Scripting Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-10-135 July 20, 2010 -- CVSS: 4.3, AV:N/AC:M/Au:N/C:P/I:N/A:N -- Affected Vendors: Novell -- Affected Products: Novell GroupWise WebAccess -- TippingPointTM IPS...
Novell GroupWise WebAccess Login Page User.lang Parameter XSS
The remote host is running Novell GroupWise WebAccess, which is vulnerable to a cross-site scripting issue in the 'User.lang' field of the login page. There are other issues known to be associated with this version of GroupWise WebAccess that Nessus has not tested for. Refer to the Secunia adviso...
CVE-2009-0272
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
CVE-2009-0272
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
CVE-2009-0272: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
CVE-2009-0273: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the 1 User.id and 2 Library.queryText parameters to gw/webacc, and other vectors involving 3 HTML e-mai...
CVE-2006-4220
Novell GroupWise WebAccess vulnerable to multiple XSS flaws in version before 7 Support Pack 3 Public Beta. Exploitation vectors involve crafted inputs in parameters (User.html, Error, User.Theme.index, User.lang) that allow remote attackers to inject arbitrary script/HTML. Root cause is cross-si...
CVE-2006-4220: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the 1 User.html, 2 Error, 3 User.Theme.index, and 4 and User.lang parameters...
Novell Groupwise 6.5 Webaccess - User.Id Cross-Site Scripting
Novell Groupwise 6.5 Webaccess - User.Id Cross-Site Scripting source: https://www.securityfocus.com/bid/25126/info Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an...
Novell Groupwise WebAccess GWINTER.EXE Base64 Decoding Remote Overflow
The remote host is running a version of GroupWise WebAccess from Novell that is vulnerable to a stack overflow in the way it handles HTTP Basic Authentication. By sending a specially crafted request, an attacker can exploit this flaw to execute code on the remote host with administrative...
ZDI-07-015: Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability
ZDI-07-015: Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-015.html April 18, 2007 -- CVE ID: CVE-2007-2171 -- Affected Vendor: Novell -- Affected Products: Groupwise WebAccess -- TippingPointTM IPS Customer Protection:...
Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists in the GWINTER.exe process bound by default on TCP ports 7205 and 7211. During the...
CVE-2006-3817: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Novell GroupWise WebAccess 6.5 and 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via an encoded SCRIPT element in an e-mail message with the UTF-7 character set, as demonstrated by the "+ADw-SCRIPT+AD4-" sequence...
CVE-2006-3818: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the login page in Novell GroupWise WebAccess 6.5 before 20060721 and WebAccess 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via the GWAP.version parameter...