344 matches found
Egroupware 1.8.005 PHP Object Insertion
Vulnerabilities in EGroupware 1.8.005 Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Vulnerability: PHP object insertion leading to all kinds of badness arbitrary file deletion, possible code executio...
CVE-2012-2211
Cross-site scripting XSS vulnerability in phpgwapi/inc/commonfunctionsinc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/processexec.php. NOTE: some of these details are obtained from third party...
Cross site scripting
Cross-site scripting XSS vulnerability in phpgwapi/inc/commonfunctionsinc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/processexec.php. NOTE: some of these details are obtained from third party...
CVE-2012-2211
CVE-2012-2211 is a documented cross-site scripting (XSS) vulnerability in eGroupware involving the file path phpgwapi/inc/common_functions_inc.php . The issue arises in versions prior to 1.8.004.20120405 , where an attacker can craft input to the parameter menuaction used by etemplate/process_exe...
CVE-2012-2211
Cross-site scripting XSS vulnerability in phpgwapi/inc/commonfunctionsinc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/processexec.php. NOTE: some of these details are obtained from third party...
CVE-2011-4950
Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
CVE-2011-4948
Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...
CVE-2011-4949
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...
Open redirect
Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...
Directory traversal
Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...
Sql injection
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...
CVE-2011-4951
Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...
CVE-2011-4948
Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...
CVE-2011-4949
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2011-4948
CVE-2011-4948 is a directory traversal vulnerability in EGroupware’s admin/remote.php. Affected products are EGroupware Enterprise Line (EPL) prior to 11.1.20110804-1 and EGroupware Community Edition prior to 1.8.001.20110805. The issue allows remote attackers to read arbitrary files by supplying...
CVE-2011-4950
CVE-2011-4950 is an XSS vulnerability in EGroupware: the file phpgwapi/js/jscalendar/test.php exposes the lang parameter, enabling remote attackers to inject arbitrary web script or HTML. Affected products are EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Editio...
CVE-2011-4949
The CVE-2011-4949 entry concerns an SQL injection in EGroupware’s web UI: phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php. Affected are EGroupware Enterprise Line (EPL) prior to 11.1.20110804-1 and EGroupware Community Edition prior to 1.8.001.20110805. The vulnerability allows remote atta...
CVE-2011-4951
CVE-2011-4951 describes an open redirect vulnerability in the file path phpgwapi/ntlm/index.php used by EGroupware’s EPL before 11.1.20110804-1 and Community Edition before 1.8.001.20110805. According to the sources, an attacker can pass a URL in the forward parameter to redirect victims to arbit...
CVE-2011-4950
Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...