CVE-2009-1635

Multiple cross-site scripting XSS vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via 1 the User.lang parameter to the login page aka gw/webacc, 2 style expressions in a message...

CVE-2009-1762

Multiple cross-site scripting XSS vulnerabilities in the WebAccess login page aka gw/webacc in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the 1 GWAP.version or 2 User.Theme aka User.Theme.index parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WebAccess login page aka gw/webacc in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the 1 GWAP.version or 2 User.Theme aka User.Theme.index parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via 1 the User.lang parameter to the login page aka gw/webacc, 2 style expressions in a message...

CVE-2009-1635

CVE-2009-1635 : Novell GroupWise WebAccess (7.x pre-7.03 HP3 and 8.x pre-8.0 HP2) is affected by cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via (1) the login page User.lang parameter, (2) style expressions in HTML emails, or (3) vectors ...

CVE-2009-1635

Multiple cross-site scripting XSS vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via 1 the User.lang parameter to the login page aka gw/webacc, 2 style expressions in a message...

CVE-2009-1762

CVE-2009-1762 corresponds to multiple XSS vulnerabilities in the Novell GroupWise WebAccess login page (gw/webacc) for GroupWise 7.x, prior to 7.03 HP2. The issue allows remote attackers to inject arbitrary web script or HTML via the GWAP.version or User.Theme (User.Theme.index) parameters. Conne...

CVE-2009-1762

Multiple cross-site scripting XSS vulnerabilities in the WebAccess login page aka gw/webacc in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the 1 GWAP.version or 2 User.Theme aka User.Theme.index parameter...

CVE-2009-1635: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via 1 the User.lang parameter to the login page aka gw/webacc, 2 style expressions in a message...

Novell Groupwise Cross Site Scripting

Novell GroupWise Web Access Multiple XSS /============================================\ / SecureState R&D Team - leroy and sasquatch \ / Discovered: 11-24-08, 03-05-09 \ \ Vendor Notified: 01-06-09, 03-05-09 / \ Vendor Publication: 05-21-09 / ============================================/...

CVE-2009-1762: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WebAccess login page aka gw/webacc in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the 1 GWAP.version or 2 User.Theme aka User.Theme.index parameter...

Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities

Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/35066/info Novell GroupWise WebAccess is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting...

Novell GroupWise < 7.03HP2 / 8.0HP1 WebAccess Multiple XSS

The version of Novell GroupWise WebAccess installed on the remote host fails to sanitize user-supplied input via a POST request to the 'User.id' parameter of the '/gw/webacc' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary...

Design/Logic Flaw

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...

CVE-2009-0274

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...

CVE-2009-0274

CVE-2009-0274 affects Novell GroupWise WebAccess components across GroupWise 6.5/7.x/8.0. The issue is described as a server-side flaw in how POST requests are converted to GET requests, allowing remote attackers to obtain sensitive information via a crafted URL. Connected sources (e.g., Seebug S...

CVE-2009-0274

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...

CVE-2009-0274: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...

CVE-2009-0272

Cross-site request forgery CSRF vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors...