CVE-2012-2211

CVE-2012-2211 is a documented cross-site scripting (XSS) vulnerability in eGroupware involving the file path phpgwapi/inc/common_functions_inc.php . The issue arises in versions prior to 1.8.004.20120405 , where an attacker can craft input to the parameter menuaction used by etemplate/process_exe...

CVE-2012-2211

Cross-site scripting XSS vulnerability in phpgwapi/inc/commonfunctionsinc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/processexec.php. NOTE: some of these details are obtained from third party...

CVE-2011-4950

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2011-4948

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...

CVE-2011-4949

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Open redirect

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...

Directory traversal

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...

Sql injection

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2011-4951

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...

CVE-2011-4948

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in the type parameter...

CVE-2011-4949

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/withdb/loaddetails.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2011-4948

CVE-2011-4948 is a directory traversal vulnerability in EGroupware’s admin/remote.php. Affected products are EGroupware Enterprise Line (EPL) prior to 11.1.20110804-1 and EGroupware Community Edition prior to 1.8.001.20110805. The issue allows remote attackers to read arbitrary files by supplying...

CVE-2011-4949

The CVE-2011-4949 entry concerns an SQL injection in EGroupware’s web UI: phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php. Affected are EGroupware Enterprise Line (EPL) prior to 11.1.20110804-1 and EGroupware Community Edition prior to 1.8.001.20110805. The vulnerability allows remote atta...

CVE-2011-4950

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2011-4950

CVE-2011-4950 is an XSS vulnerability in EGroupware: the file phpgwapi/js/jscalendar/test.php exposes the lang parameter, enabling remote attackers to inject arbitrary web script or HTML. Affected products are EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Editio...

CVE-2011-4951

CVE-2011-4951 describes an open redirect vulnerability in the file path phpgwapi/ntlm/index.php used by EGroupware’s EPL before 11.1.20110804-1 and Community Edition before 1.8.001.20110805. According to the sources, an attacker can pass a URL in the forward parameter to redirect victims to arbit...

Egroupware 1.8.002 Cross Site Scripting

Egroupware v1.8.002 processexec.php Reflected Cross-Site Scripting XSS Google Dork: inurl:etemplate/processexec.php Title: Egroupware v1.8.002 processexec.php Remote XSS Vulnerability Type: Remote Author: Marcos Garcia Severity: Medium – CVSS: 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Impact: Direct execution...

eGroupware Premium Line v9.1 - SQL Injection Vulnerability

Document Title: =============== eGroupware Premium Line v9.1 - SQL Injection Vulnerability Release Date: ============= 2011-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 81 Product & Service Introduction: =============================== EPL is the professional choi...

eGroupWare CMS v1.6.x - Multiple Web Vulnerabilities

Document Title: =============== eGroupWare CMS v1.6.x - Multiple Web Vulnerabilities Release Date: ============= 2011-07-09 Vulnerability Laboratory ID VL-ID: ==================================== 137 Product & Service Introduction: =============================== eGroupWare is many things. It is ...