CVE-2004-1383

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the 1 order, 2 projectid, 3 promain, or 4 hoursid parameters to index.php or 5 ticketid to viewticketdetails.php...

CVE-2004-1385

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via 1 unexpected characters in the session ID such as shell metacharacters, 2 an invalid appname parameter to preferences.php or 3 an invalid menuaction parameter to index.php, which reveals the web server...

CVE-2004-1384

Multiple cross-site scripting XSS vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 kp3, 2 type, 3 msg, 4 forumid, 5 pos, 6 catsapp, 7 catid, 8 msgballmsgnum, 9 fldballacctnum parameters to index.php or 10 ticketid to...

CVE-2004-2407

Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Config functionality...

CVE-2004-2575

phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to 1 hookadmin.inc.php, 2 hookhome.inc.php, 3 class.holidaycalc.inc.php, and 4 setup.inc.php.sample, which reveals the path in an error message...

CVE-2004-2574

Cross-site scripting XSS vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction...

phpGroupWare.txt

GulfTech Security Research December 14th, 2004 Vendor : phpGroupWare URL : http://www.phpgroupware.org Version : phpGroupWare 0.9.16.003 Risk : Multiple Vulnerabilities Description: phpGroupWare formerly known as webdistro is a multi-user groupware suite written in PHP. It provides a Web-based...

CVE-2004-0875

Multiple cross-site scripting XSS vulnerabilities in Phpgroupware aka webdistro 0.9.16.002 and earlier allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to the wiki module...

phpGroupWare Detection

The remote host is running PHPGroupWare, a groupware system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15982; scriptversion"1.19"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"phpGroupWare Detection"...

phpGroupWare <= 0.9.16.003 Multiple Vulnerabilities

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. The remote version of this software is vulnerable to multiple issues : - A cross-site scripting issue may allow an attacker to steal the credentials of third-party users of the remote host. CVE-2004-138...

phpGroupWare 0.9.x - index.php Multiple SQL Injections

phpGroupWare 0.9.x - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of t...

phpGroupWare 0.9.x - index.php Multiple Cross-Site Scripting Vulnerabilities

phpGroupWare 0.9.x - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all...

phpGroupWare 0.9.x - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' SQL Injection

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

Multiple phpGroupWare Vulnerabilities [ phpGroupWare 0.9.16.003 && Earlier ]

GulfTech Security Research December 14th, 2004 Vendor : phpGroupWare URL : http://www.phpgroupware.org Version : phpGroupWare 0.9.16.003 Risk : Multiple Vulnerabilities Description: phpGroupWare formerly known as webdistro is a multi-user groupware suite written in PHP. It provides a Web-based...

PHPGroupWare Multiple XSS and SQL Injection Vulnerabilities

Binary data 2457.prm...

phpGroupWare phpgw.inc.php phpgw_info Parameter Remote File Inclusion

The version of PhpGroupWare hosted on the remote web server has a vulnerability that may permit remote attackers to execute arbitrary commands through the 'phpgwinfo' parameter of the 'phpgw.inc.php' script, resulting in a loss of integrity. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-419-1 : phpgroupware - missing filename sanitising, SQL injection

The authors of phpgroupware, a web-based groupware system written in PHP, discovered several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2004-0016 In the 'calendar' module, 'save extension' was not enforced for holiday files. As a...

Debian DSA-365-1 : phpgroupware - several vulnerabilities

Several vulnerabilities have been discovered in phpgroupware : - CAN-2003-0504: Multiple cross-site scripting XSS vulnerabilities in Phpgroupware 0.9.14.003 aka webdistro allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to index.php in the addressbook...