CVE-2004-0875

The CVE-2004-0875 entry concerns PhpGroupWare (aka webdistro) 0.9.16.002 and earlier, where the wiki module is vulnerable to cross-site scripting (XSS). The underlying issue is improper input handling/sanitization in the wiki component, enabling remote attackers to inject arbitrary HTML/script co...

CVE-2004-0875

Multiple cross-site scripting XSS vulnerabilities in Phpgroupware aka webdistro 0.9.16.002 and earlier allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to the wiki module...

GLSA-200409-22 : phpGroupWare: XSS vulnerability in wiki module

The remote host is affected by the vulnerability described in GLSA-200409-22 phpGroupWare: XSS vulnerability in wiki module Due to an input validation error, the wiki module in the phpGroupWare suite is vulnerable to cross site scripting attacks. Impact : This vulnerability gives an attacker the...

phpGroupWare: XSS vulnerability in wiki module

Background phpGroupWare is a web-based suite of group applications including calendar, todo-list, addressbook, email, wiki, news headlines, and a file manager. Description Due to an input validation error, the wiki module in the phpGroupWare suite is vulnerable to cross site scripting attacks...

phpGroupWare Wiki Module XSS

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. This issue exists due to a lack of sanitization of user-supplied data. A malicious attacker can exploit a flaw to conduct cross-site scripting attacks. %NASLMINLEVEL 70300 C Tenable Network Security, In...

PHPGroupWare < 0.9.16.003 Wiki Module XSS

Binary data 2269.prm...

CVE-2004-0016

Summary (CVE-2004-0016) : The phpGroupWare calendar module (version 0.9.14) fails to enforce the save extension for holiday files, allowing server-side PHP files to be created and executed. This is a remote vulnerability with a CVSS v2 base score of 7.5 (High). Related advisories patch the issue ...

CVE-2004-0016

The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files...

phpGroupWare Multiple Module SQL Injection

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. It has been reported that this version may be prone to multiple SQL injection vulnerabilities in the 'calendar' and 'infolog' modules. The problems exist due to insufficient sanitization of user-supplie...

phpGroupWare Calendar Module Holiday File Save Extension Feature Arbitrary File Execution

It has been reported that the version of phpGroupWare hosted on the remote web server may be affected by a vulnerability that allows remote attackers to upload scripts and then execute them on the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

phpGroupWare index.php Addressbook XSS

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. This version is reportedly prone to multiple HTML injection vulnerabilities. The issues present themselves due to a lack of sufficient input validation performed on form fields used by PHPGroupWare...

phpGroupWare Admin/Setup Password Plaintext Cookie Storage

The version of PhpGroupWare installed on the remote host is reported to be affected by a plaintext cookie authentication credentials information disclosure vulnerability. If web administration of PhpGroupWare is not conducted over an encrypted link, an attacker with the ability to sniff network...

phpGroupWare Unspecified Remote File Inclusion

The version of PhpGroupWare hosted on the remote web server has a vulnerability that may permit remote attackers, without prior authentication, to include and execute malicious PHP scripts. Remote users may influence URI variables to include a malicious PHP script on a remote system, it is possib...

Mandrake Linux Security Advisory : phpgroupware (MDKSA-2003:077)

Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is...

CVE-2004-0017

Multiple SQL injection vulnerabilities in the 1 calendar and 2 infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations...

CVE-2004-0016

The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files...

phpGroupWare 0.9.14 - Tables_Update.Inc.php Remote File Inclusion

phpGroupWare 0.9.14 - TablesUpdate.Inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/12074/info phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server...

phpGroupWare 0.9.14 - 'Tables_Update.Inc.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/12074/info phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server. The tablesupdate.inc.php script contains the following include...

CVE-2004-0017

Multiple SQL injection vulnerabilities in the 1 calendar and 2 infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations...

CVE-2004-0017

PhpGroupWare (calendar and infolog modules, version 0.9.14 era) is affected by SQL injection vulnerabilities due to non-escaping of user-supplied data, enabling remote attackers to influence SQL query logic. Public sources (Debian DSA-419, OpenVAS entries, and NVD reference) confirm CAN-2004-0017...