CVE-2010-3313

CVE-2010-3313 affects EGroupware and EPL components: the spellchecker PHP script (spellchecker.php) in phpgwapi/js/fckeditor/.../spellchecker.php allows remote command execution via shell metacharacters in the aspell_path and spellchecker_lang parameters. Affected: EGroupware 1.4.001+.002 and 1.6...

CVE-2010-3314

Cross-site scripting XSS vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2010-3313

phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...

CVE-2010-3314

CVE-2010-3314 is a cross-site scripting (XSS) vulnerability in EGroupware: login.php vulnerable in EGroupware 1.4.001+.002 and 1.6.001+.002 (and EPL 9.1 pre-9.1.20100309, 9.2 pre-9.2.20100309). The lang parameter can inject arbitrary script/HTML. Affected versions include 1.6.x before 1.6.003 and...

CVE-2010-3313

phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...

eGroupWare < 1.6.003 Mutiple Vulnerabilities

Binary data 5365.prm...

EGroupware 1.6.002 / EGroupware Premium Line 9.1 Multiple Vulnerability

Exploit for unknown platform in category web applications ========================================================================= EGroupware 1.6.002 / EGroupware Premium Line 9.1 Multiple Vulnerabilities ========================================================================= Advisory Name:...

FreeBSD Ports: egroupware

The remote host is missing an update to the system as announced in the referenced advisory. VID e39caf05-2d6f-11df-aec2-000c29ba66d2 OpenVAS Vulnerability Test $ Description: Auto generated from VID e39caf05-2d6f-11df-aec2-000c29ba66d2 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

eGroupWare 1.6.002 and eGroupWare premium line 9.1 - Multiple Vulnerabilities

eGroupWare 1.6.002 and eGroupWare premium line 9.1 - Multiple Vulnerabilities Advisory Name: Remote Command Execution in EGroupware Vulnerability Class: Remote Command Execution Release Date: 2010-03-09 Affected Applications: Confirmed in EGroupware 1.4.001+.002 and 1.6.001+.002. EGroupware Premi...

Debian: Security Advisory (DSA-2013-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2013-1 (egroupware)

The remote host is missing an update to egroupware announced via advisory DSA 2013-1. OpenVAS Vulnerability Test $Id: deb20131.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2013-1 egroupware Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

FreeBSD Ports: egroupware

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

[SECURITY] [DSA 2013-1] New egroupware packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2013-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 11, 2010 http://www.debian.org/security/faq -...

Debian DSA-2013-1 : egroupware - several vulnerabilities

Nahuel Grisolia discovered two vulnerabilities in Egroupware, a web-based groupware suite: Missing input sanitising in the spellchecker integration may lead to the execution of arbitrary commands and a cross-site scripting vulnerability was discovered in the login page. %NASLMINLEVEL 70300 C...

eGroupware跨站脚本和远程命令执行漏洞

BUGTRAQ ID: 38609 eGroupWare是一套PHP语言开发的团队协作软件，采用GPL的开放源码授权。 eGroupWare没有正确地过滤提交给login.php页面的lang参数便返回给了用户，远程攻击者可以通过提交恶意参数请求执行跨站脚本攻击；此外由于没有正确地过滤提交给phpgwapi/js/fckeditor/editor/dialog/fckspellerpages /spellerpages/server-scripts/spellchecker.php的spellcheckerlang参数，远程用户可以注入并执行任意shell命令。 EGroupware.o...

FreeBSD : egroupware -- two vulnerabilities (e39caf05-2d6f-11df-aec2-000c29ba66d2)

Egroupware Team report : Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware : Serious remote command execution allowing to run arbitrary command on the web server by simply issuing a HTTP request!. A reflected cross-site scripting XSS. Both require NO vali...

[SECURITY] [DSA 2013-1] New egroupware packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2013-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 11, 2010 http://www.debian.org/security/faq -...

DSA-2013-1 egroupware - several vulnerabilities

Bulletin has no description...

eGroupWare spellchecker.php Arbitrary Shell Command Execution

The version of eGroupWare hosted on the remote web server fails to sanitize user-supplied input to the 'aspellpath' and/or 'spellcheckerlang' parameters of the 'spellchecker.php' script before passing it to a shell. An unauthenticated, remote attacker can leverage these issues to execute arbitrar...

egroupware -- two vulnerabilities

Egroupware Team report: Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware: Serious remote command execution allowing to run arbitrary command on the web server by simply issuing a HTTP request!. A reflected cross-site scripting XSS. Both require NO valid...