DSA-2046-1 phpgroupware - several vulnerabilities

Bulletin has no description...

Debian DSA-1978-1 : phpgroupware - several vulnerabilities

Several remote vulnerabilities have been discovered in phpgroupware, a Web-based groupware system written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-4414 A SQL injection vulnerability was found in the authentication module. -...

Debian Security Advisory DSA 1978-1 (phpgroupware)

The remote host is missing an update to phpgroupware announced via advisory DSA 1978-1. OpenVAS Vulnerability Test $Id: deb19781.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 1978-1 phpgroupware Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft In...

Debian: Security Advisory (DSA-1978-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 1978-1] New phpgroupware packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1978-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 26, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1978-1] New phpgroupware packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1978-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 26, 2010 http://www.debian.org/security/faq -...

DSA-1978-1 phpgroupware - several vulnerabilities

Bulletin has no description...

phpGroupWare多个输入验证漏洞

BUGTRAQ ID: 35761 CVE ID: CVE-2009-4414,CVE-2009-4415,CVE-2009-4416 phpGroupWare是一个用PHP编写的多用户的网络组件，为开发其他程序提供了一个API。 phpGroupWare的多个组件中存在输入验证错误，远程攻击者可以通过提交恶意请求泄露敏感信息、执行跨站脚本或SQL注入攻击。 1 没有正确地验证传送给csvfile参数的输入便在addressbook/csvimport.php中使用，这可能导致在受影响系统上读取任意文件的内容。 2...

CVE-2009-4416

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

Directory traversal

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to 1 read arbitrary files via the csvfile parameter to addressbook/csvimport.php, or 2 include and execute arbitrary local files via the convtype parameter...

Sql injection

SQL injection vulnerability in phpgwapi /inc/class.authsql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php...

CVE-2009-4414

SQL injection vulnerability in phpgwapi /inc/class.authsql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php...

CVE-2009-4415

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to 1 read arbitrary files via the csvfile parameter to addressbook/csvimport.php, or 2 include and execute arbitrary local files via the convtype parameter...

CVE-2009-4414

SQL injection vulnerability in phpgwapi /inc/class.authsql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php...

CVE-2009-4416

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

Cross site scripting

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

CVE-2009-4415

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to 1 read arbitrary files via the csvfile parameter to addressbook/csvimport.php, or 2 include and execute arbitrary local files via the convtype parameter...

CVE-2009-4416

The CVE-2009-4416 issue affects phpgroupware, specifically the login.php module, where an input validation flaw allows cross-site scripting via arbitrary parameters starting with phpgw_. This is documented in Debian DSA-1978-1 and related OpenVAS entries, which describe multiple remote vulnerabil...

CVE-2009-4414

CVE-2009-4414 concerns phpGroupWare. The vulnerability is an SQL injection in the authentication path: phpGroupWare’s phpgwapi/inc/class.auth_sql.inc.php allows remote attackers to execute arbitrary SQL via the passwd parameter on login.php, typically when magic_quotes_gpc is disabled. Affected v...

CVE-2009-4415

CVE-2009-4415 is a directory traversal vulnerability in phpgroupware that allows remote attackers to read arbitrary files via the addressbook/csv_import.php csvfile parameter or to include local files via addressbook/inc/class.uiXport.inc.php conv_type parameter. The issue affects PHPGroupWare 0....