CVE-2010-2779

This CVE (CVE-2010-2779) affects Novell GroupWise 8.x WebAccess prior to 8.0 SP2. The issue is a cross-site scripting (XSS) vulnerability in WebAccess when handling HTML messages, related to “replies.” The underlying flaw allows remote attackers to inject arbitrary client-side script into the use...

CVE-2010-2778

This entry concerns CVE-2010-2778, a Cross-site Scripting (XSS) vulnerability in Novell GroupWise WebAccess. The affected products are GroupWise WebAccess 7.x prior to 7.0 post-SP4 FTF and 8.x prior to 8.0 SP2. The underlying issue is improper handling/sanitization of HTML in messages, allowing r...

CVE-2010-4326

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long 1 REQUEST-STATUS, 2 TZNAME, 3 COMMENT, or 4 RRULE variable in this message...

CVE-2010-4325

Buffer overflow in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message...

Buffer overflow

Buffer overflow in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message...

Buffer overflow

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long 1 REQUEST-STATUS, 2 TZNAME, 3 COMMENT, or 4 RRULE variable in this message...

CVE-2010-4326

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long 1 REQUEST-STATUS, 2 TZNAME, 3 COMMENT, or 4 RRULE variable in this message...

CVE-2010-4325

Buffer overflow in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message...

CVE-2010-4326

The CVE-2010-4326 issue affects Novell GroupWise Internet Agent (GWIA) via a buffer overflow in gwwww1.dll when parsing VCALENDAR data (RRULE/REQUEST-STATUS variables). This can allow remote code execution; exploitation is possible by sending a crafted email and does not require authentication (p...

CVE-2010-4325

CVE-2010-4325 affects Novell GroupWise via the GWIA gwwww1.dll: a vulnerability in VCALENDAR data TZID handling can cause a remote buffer overflow. Exploitation can lead to arbitrary code execution with SYSTEM privileges. Affected products: GroupWise 8.0x up to 8.02HP2. The issue is triggered by ...

VUPEN Security Research - Novell GroupWise "TZID" Variable Remote Buffer Overflow Vulnerability (VUPEN-SR-2011-004)

VUPEN Security Research - Novell GroupWise VCALENDAR "TZID" Variable Remote Buffer Overflow Vulnerability VUPEN-SR-2011-004 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Novell GroupWise collaboration software is a premier collaboration tool for large enterprise...

Novell GroupWise buffer overflow

Buffer overflow on oversized VCALENDAR TZID variable...

GroupWise Internet Agent < 8.0.2 HP2 Email Message VCALENDAR Data TZID Variable Remote Overflow

The version of GroupWise Internet Agent installed on the remote host is older than 8.0.2.12377 and hence reportedly affected by an buffer overflow vulnerability. The installed version fails to correctly parse 'VCALENDAR' data within an email message containing a specially crafted 'TZID' variable...

Novell GroupWise Internet Agent TZID Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gwwww1.dll module responsible for parsing VCALENDAR data within e-mail messages...

Novell GroupWise Internet Agent REQUEST-STATUS Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gwwww1.dll module responsible for parsing VCALENDAR data within e-mail messages...

Update Protection against Novell GroupWise Internet Agent Content-Type Buffer Overflow

A buffer overflow vulnerability was reported in Novell GroupWise Internet Agent GWIA, a component of Novell GroupWise. GWIA provides email services and support in SMTP, POP, and IMAP protocols. The vulnerability is due to improper validation of data received within the "Content-Type" header of...

Preemptive Protection against Novell GroupWise Agents HTTP Request Remote Code Execution

A code execution vulnerability exists in the GroupWise agents HTTP interfaces. The vulnerability is due to insufficient bounds checking while parsing the Host header from an HTTP GET request. A remote attacker could exploit this vulnerability by sending a crafted HTTP request to the server...

Preemptive Protection against Novell GroupWise Internet Agent RRULE Parsing Buffer Overflow

A remote code execution vulnerability exists in Novell GroupWise Internet Agent GWIA. Novell GroupWise Internet Agent is a component of Novell GroupWise and provides email services, supporting SMTP, POP, and IMAP protocols. The vulnerability is due to a buffer overflow when parsing a RRULE variab...

Novell GroupWise WebAccess Arbitrary File Download

The installed version of GroupWise WebAccess fails to perform sufficient validation on a user specified file name supplied via 'filename' parameter before returning the contents of the file. By supplying directory traversal strings such as '../' in a specially crafted 'GET' request, it may be...

Novell GroupWise WebAccess Arbitrary File Download (local check)

The installed version of GroupWise WebAccess fails to perform sufficient validation on a user specified file name supplied via the 'filename' parameter before returning the contents of the file. By supplying directory traversal strings such as '../' in a specially crafted 'GET' request, it may be...