CVE-2009-2355: Undefined Security Weakness

The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...

CVE-2009-2356: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the 1 POP3, 2 SMTP, or 3 web component that triggers a long SQL query...

CVE-2009-2354: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the authcheckpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter...