2705 matches found
CVE-2009-1635
Multiple cross-site scripting XSS vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via 1 the User.lang parameter to the login page aka gw/webacc, 2 style expressions in a message...
CVE-2009-1762
CVE-2009-1762 corresponds to multiple XSS vulnerabilities in the Novell GroupWise WebAccess login page (gw/webacc) for GroupWise 7.x, prior to 7.03 HP2. The issue allows remote attackers to inject arbitrary web script or HTML via the GWAP.version or User.Theme (User.Theme.index) parameters. Conne...
CVE-2009-1762
Multiple cross-site scripting XSS vulnerabilities in the WebAccess login page aka gw/webacc in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the 1 GWAP.version or 2 User.Theme aka User.Theme.index parameter...
Novell Groupwise Cross Site Scripting
Novell GroupWise Web Access Multiple XSS /============================================\ / SecureState R&D Team - leroy and sasquatch \ / Discovered: 11-24-08, 03-05-09 \ \ Vendor Notified: 01-06-09, 03-05-09 / \ Vendor Publication: 05-21-09 / ============================================/...
Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities
Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting...
Novell GroupWise < 7.03HP2 / 8.0HP1 WebAccess Multiple XSS
The version of Novell GroupWise WebAccess installed on the remote host fails to sanitize user-supplied input via a POST request to the 'User.id' parameter of the '/gw/webacc' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary...
Design/Logic Flaw
Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...
CVE-2009-0274
Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...
CVE-2009-0274
CVE-2009-0274 affects Novell GroupWise WebAccess components across GroupWise 6.5/7.x/8.0. The issue is described as a server-side flaw in how POST requests are converted to GET requests, allowing remote attackers to obtain sensitive information via a crafted URL. Connected sources (e.g., Seebug S...
CVE-2009-0274
Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...
CVE-2009-0272
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
CVE-2009-0273
Multiple cross-site scripting XSS vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the 1 User.id and 2 Library.queryText parameters to gw/webacc, and other vectors involving 3 HTML e-mai...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the 1 User.id and 2 Library.queryText parameters to gw/webacc, and other vectors involving 3 HTML e-mai...
CVE-2009-0273
Multiple cross-site scripting XSS vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the 1 User.id and 2 Library.queryText parameters to gw/webacc, and other vectors involving 3 HTML e-mai...
CVE-2009-0272
CVE-2009-0272 affects Novell GroupWise WebAccess versions 6.5x, 7.x, and 8.0. It is a CSRF vulnerability that allows a remote attacker to forge HTTP requests to alter configuration settings (e.g., insertion of e-mail forwarding rules) on behalf of an authenticated user. The issue is noted as CSRF...
CVE-2009-0272
Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...
CVE-2009-0273
CVE-2009-0273 affects Novell GroupWise WebAccess (versions 6.5x, 7.0/7.01/7.02x/7.03/7.03HP1a, and 8.0). The vulnerability stems from cross-site scripting via unsanitized input in the WebAccess component, notably the POST parameters User.id and Library.queryText to /gw/webacc, with additional vec...
PR08-21: Cross-site Request Forgery (CSRF) on Novell GroupWise WebAccess allows email theft and other attacks
PR08-21: Cross-site Request Forgery CSRF on Novell GroupWise WebAccess allows email theft and other attacks Vulnerability found: 3rd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: Critical Credits: Adrian Pastor of ProCheckUp Ltd...
PR08-22: Persistent XSS on Novell GroupWise WebAccess
PR08-22: Persistent XSS on Novell GroupWise WebAccess Vulnerability found: 2nd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: High Credits: Jan Fry of ProCheckUp Ltd www.procheckup.com. ProCheckUp thanks Novell for working with us in such a...