CVE-2004-2578

phpGroupWare before 0.9.16.002 transmits the 1 header admin and 2 setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords...

CVE-2004-2577

The aclcheck function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts...

CVE-2004-2575

phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to 1 hookadmin.inc.php, 2 hookhome.inc.php, 3 class.holidaycalc.inc.php, and 4 setup.inc.php.sample, which reveals the path in an error message...

CVE-2004-2573

PHP remote file inclusion vulnerability in tablesupdate.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter...

CVE-2004-1383

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the 1 order, 2 projectid, 3 promain, or 4 hoursid parameters to index.php or 5 ticketid to viewticketdetails.php...

CVE-2004-1384

Multiple cross-site scripting XSS vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 kp3, 2 type, 3 msg, 4 forumid, 5 pos, 6 catsapp, 7 catid, 8 msgballmsgnum, 9 fldballacctnum parameters to index.php or 10 ticketid to...

CVE-2004-1385

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via 1 unexpected characters in the session ID such as shell metacharacters, 2 an invalid appname parameter to preferences.php or 3 an invalid menuaction parameter to index.php, which reveals the web server...

phpGroupWare.txt

GulfTech Security Research December 14th, 2004 Vendor : phpGroupWare URL : http://www.phpgroupware.org Version : phpGroupWare 0.9.16.003 Risk : Multiple Vulnerabilities Description: phpGroupWare formerly known as webdistro is a multi-user groupware suite written in PHP. It provides a Web-based...

CVE-2004-0875

Multiple cross-site scripting XSS vulnerabilities in Phpgroupware aka webdistro 0.9.16.002 and earlier allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to the wiki module...

phpGroupWare Detection

The remote host is running PHPGroupWare, a groupware system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15982; scriptversion"1.19"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"phpGroupWare Detection"...

phpGroupWare <= 0.9.16.003 Multiple Vulnerabilities

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. The remote version of this software is vulnerable to multiple issues : - A cross-site scripting issue may allow an attacker to steal the credentials of third-party users of the remote host. CVE-2004-138...

PHPGroupWare Multiple XSS and SQL Injection Vulnerabilities

Binary data 2457.prm...

phpGroupWare 0.9.x - index.php Multiple SQL Injections

phpGroupWare 0.9.x - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of t...

phpGroupWare 0.9.x - index.php Multiple Cross-Site Scripting Vulnerabilities

phpGroupWare 0.9.x - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all...

Multiple phpGroupWare Vulnerabilities [ phpGroupWare 0.9.16.003 && Earlier ]

GulfTech Security Research December 14th, 2004 Vendor : phpGroupWare URL : http://www.phpgroupware.org Version : phpGroupWare 0.9.16.003 Risk : Multiple Vulnerabilities Description: phpGroupWare formerly known as webdistro is a multi-user groupware suite written in PHP. It provides a Web-based...

phpGroupWare 0.9.x - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

phpGroupWare 0.9.x - 'viewticket_details.php?ticket_id' SQL Injection

source: https://www.securityfocus.com/bid/11952/info Reportedly PHPGroupWare contains multiple input validation vulnerabilities; it is prone to multiple SQL injection and cross-site scripting issues. These issues are all due to a failure of the application to properly sanitize user-supplied input...

phpGroupWare phpgw.inc.php phpgw_info Parameter Remote File Inclusion

The version of PhpGroupWare hosted on the remote web server has a vulnerability that may permit remote attackers to execute arbitrary commands through the 'phpgwinfo' parameter of the 'phpgw.inc.php' script, resulting in a loss of integrity. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-419-1 : phpgroupware - missing filename sanitising, SQL injection

The authors of phpgroupware, a web-based groupware system written in PHP, discovered several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2004-0016 In the 'calendar' module, 'save extension' was not enforced for holiday files. As a...