DSA-1063-1 phpgroupware - missing input sanitising

Bulletin has no description...

PhpGroupWare Addressbook < 0.9.16 Unspecified Flaw

The remote host seems to be running PhpGroupWare, is a multi-user groupware suite written in PHP. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PhpGroupWare Main Screen Message Script Injection Flaw

The remote host seems to be running PhpGroupWare, is a multi-user groupware suite written in PHP. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Ubuntu 4.10 / 5.04 : php4, php4-universe vulnerability (USN-147-1)

A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR PHP Extension and Application Repository extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web...

CVE-2004-2574

CVE-2004-2574 affects PhpGroupWare up to version 0.9.14.005 (and earlier). The vulnerability is a cross-site scripting (XSS) flaw in index.php where the date parameter in calendar.uicalendar.planner menuaction can be manipulated to inject arbitrary web script or HTML. Multiple connected sources (...

CVE-2004-2576

class.vfsdav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files...

CVE-2004-2573

CVE-2004-2573: PHP remote file inclusion in phpGroupWare 0.9.14.005 and earlier. The flaw is in tables_update.inc.php, allowing an attacker to execute arbitrary PHP code by supplying an external URL in the appdir parameter. Affected: phpGroupWare versions up to and including 0.9.14.005. Root caus...

CVE-2004-2575

CVE-2004-2575 affects phpGroupWare 0.9.14.005 and earlier. The flaw allows remote attackers to disclose sensitive information by requesting certain files (hook_admin.inc.php, hook_home.inc.php, class.holidaycalc.inc.php, setup.inc.php.sample), which causes an error message revealing the path. The...

CVE-2004-2578

PhpGroupWare before 0.9.16.002 transmits the (1) admin header and (2) setup passwords in plaintext via cookies, allowing remote attackers to sniff passwords over the network. The issue is documented with CVSS v2 base score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Concrete affected product/component: Php...

CVE-2004-2573

PHP remote file inclusion vulnerability in tablesupdate.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter...

CVE-2004-2574

Cross-site scripting XSS vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction...

CVE-2004-2577

The CVE concerns phpGroupWare 0.9.16RC2, where acl_check always returns True, potentially revealing WebDAV-stored data from home directories without .htaccess. The underlying cause is the incorrect authorization result when mkdir behaves unexpectedly. Publicly stated impact includes disclosure of...

CVE-2004-2576

CVE-2004-2576 affects phpGroupWare 0.9.16.000; the component class.vfs_dav.inc.php fails to create .htaccess files to enable authorization checks for access to users’ home-directory files. This leads to potential disclosure of sensitive information by remote attackers. The NVD entry lists CVSS v2...

CVE-2004-2575

phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to 1 hookadmin.inc.php, 2 hookhome.inc.php, 3 class.holidaycalc.inc.php, and 4 setup.inc.php.sample, which reveals the path in an error message...

CVE-2004-2578

phpGroupWare before 0.9.16.002 transmits the 1 header admin and 2 setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords...

CVE-2004-2577

The aclcheck function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts...

DEBIAN-CVE-2005-3347

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. dot dot sequences in the 1 sensorprogram parameter or the 2...

DEBIAN-CVE-2005-3348

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter...

CVE-2005-3347

CVE-2005-3347 describes multiple directory traversal flaws in phpSysInfo 2.4 and earlier, impacting phpSysInfo itself and also affecting phpgroupware 0.9.16 and earlier, and egrouwpware prior to 1.0.0.009. The vulnerabilities allow remote attackers to include arbitrary files by supplying dot-dot ...

CVE-2005-3347

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. dot dot sequences in the 1 sensorprogram parameter or the 2...