CVE-2021-39271

CVE-2021-39271 (BSCW Classic / OrbiTeam BSCW Classic) : Authenticated remote code execution is possible during archive extraction via attacker-supplied Python code embedded in the class attribute of a .bscw file. Root cause: execution of Python code during extraction in affected BSCW Classic depl...

CVE-2021-39271

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution RCE during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3...

CVE-2021-36359

CVE-2021-36359 affects OrbiTeam BSCW Classic/BSCW Server up to version 7.4.3. The vulnerability is an XML tag injection that leads to authenticated remote code execution when reportlab/platypus/paraparser.py evaluates attacker-supplied Python code via bscw.cgi op=_editfolder.EditFolder. Impact is...

CVE-2021-36359

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution RCE via XML tag injection because reportlab\platypus\paraparser.py reached via bscw.cgi op=editfolder.EditFolder calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and...

OrbiTeam BSCW Classic安全漏洞

OrbiTeam BSCW Classic is OrbiTeam Software GmbH's versatile system for any application. A security vulnerability exists in OrbiTeam BSCW Classic versions prior to 7.4.3, which can be exploited by an attacker to call Python code via XML tags, fixed in versions 5.0.12, 5.1.10, 5.2.4, 7.3.3 and 7.4....

OrbiTeam BSCW Classic 安全漏洞

OrbiTeam BSCW Classic is OrbiTeam Software GmbH's versatile system for any application. A security vulnerability in OrbiTeam BSCW Classic versions prior to 7.4.3, which could be exploited by an attacker to provide Python code in the class attribute of a .BSCW file to execute authenticated Remote...

OrbiTeam BSCW 'op' Parameter Information Disclosure Vulnerability

OrbiTeam BSCW is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2014-2301

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

Buffer overflow

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

CVE-2014-2301

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

CVE-2014-2301

OrbiTeam BSCW contains an information-disclosure flaw in the pub/bscw.cgi/?op=inf path. Versions ≤ 5.0.7 (pre-5.0.8) allow unauthenticated attackers to read metadata for internal objects (e.g., filenames, and potentially email addresses). The root cause is information leakage via the inf operatio...

[RT-SA-2014-003] Metadata Information Disclosure in OrbiTeam BSCW

Advisory: Metadata Information Disclosure in OrbiTeam BSCW RedTeam Pentesting discovered an information disclosure vulnerability in OrbiTeam's BSCW collaboration software. An unauthenticated attacker can disclose metadata about internal objects which are stored in BSCW. Details ======= Product:...

OrbiTeam BSCW 5.0.7 Metadata Information Disclosure Vulnerability

RedTeam Pentesting discovered an information disclosure vulnerability in OrbiTeam's BSCW collaboration software. An unauthenticated attacker can disclose metadata about internal objects which are stored in BSCW. Versions 5.0.7 and below are affected. RedTeam Pentesting discovered an information...

OrbiTeam BSCW 5.0.7 Metadata Information Disclosure

Advisory: Metadata Information Disclosure in OrbiTeam BSCW RedTeam Pentesting discovered an information disclosure vulnerability in OrbiTeam's BSCW collaboration software. An unauthenticated attacker can disclose metadata about internal objects which are stored in BSCW. Details ======= Product:...

CVE-2002-0094

configconverters.py in BSCW Basic Support for Cooperative Work 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion...

CVE-2002-0094

CVE-2002-0094 affects BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06. The vulnerability arises from config_converters.py, allowing remote command execution via shell metacharacters in file names during filename conversion. Root cause is inadequate validation of file-name i...

CVE-2002-0095

CVE-2002-0095 affects BSCW (Basic Support for Cooperative Work) in its default configuration (3.x and possibly 4) where user self-registration is enabled. This could allow remote attackers to upload files and potentially join a user community that was intended to be closed. The CVSS metrics indic...

CVE-2002-0095

The default configuration of BSCW Basic Support for Cooperative Work 3.x and possibly version 4 enables user self registration, which could allow remote attackers to upload files and possibly join a user community that was intended to be closed...

CVE-2002-0094

configconverters.py in BSCW Basic Support for Cooperative Work 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion...

CVE-2001-0973

CVE-2001-0973 concerns BSCW groupware (versions 3.3–4.0.2 beta). The vulnerability arises when extracting tar archives into the user’s data-bag space: symbolic links within the tar are followed, allowing a remote attacker to read arbitrary files readable by the web server and potentially overwrit...