CVE-2004-2578

phpGroupWare before 0.9.16.002 transmits the 1 header admin and 2 setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords...

CVE-2004-2573

CVE-2004-2573: PHP remote file inclusion in phpGroupWare 0.9.14.005 and earlier. The flaw is in tables_update.inc.php, allowing an attacker to execute arbitrary PHP code by supplying an external URL in the appdir parameter. Affected: phpGroupWare versions up to and including 0.9.14.005. Root caus...

CVE-2004-2573: Undefined Security Weakness

PHP remote file inclusion vulnerability in tablesupdate.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter...

CVE-2004-2577: Undefined Security Weakness

The aclcheck function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts...

CVE-2004-2576: Undefined Security Weakness

class.vfsdav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files...

CVE-2004-2578: Undefined Security Weakness

phpGroupWare before 0.9.16.002 transmits the 1 header admin and 2 setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords...

CVE-2004-2575: Undefined Security Weakness

phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to 1 hookadmin.inc.php, 2 hookhome.inc.php, 3 class.holidaycalc.inc.php, and 4 setup.inc.php.sample, which reveals the path in an error message...

CVE-2004-2574: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction...

DEBIAN-CVE-2005-3348

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter...

DEBIAN-CVE-2005-3347

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. dot dot sequences in the 1 sensorprogram parameter or the 2...

CVE-2005-3348

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter...

CVE-2005-3348

CVE-2005-3348 is a HTTP Response Splitting vulnerability in phpSysInfo (2.4 and earlier) used by phpGroupWare (0.9.16 and earlier) and eGroupWare (before 1.0.0.009). Exploitation via CRLF sequences in the charset parameter can cause web content spoofing and cache poisoning. OpenVAS entries (and D...

CVE-2005-3347

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. dot dot sequences in the 1 sensorprogram parameter or the 2...

CVE-2005-3347

CVE-2005-3347 describes multiple directory traversal flaws in phpSysInfo 2.4 and earlier, impacting phpSysInfo itself and also affecting phpgroupware 0.9.16 and earlier, and egrouwpware prior to 1.0.0.009. The vulnerabilities allow remote attackers to include arbitrary files by supplying dot-dot ...

CVE-2005-3347: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. dot dot sequences in the 1 sensorprogram parameter or the 2...

CVE-2005-3348: Cross-Site Request Forgery (CSRF)

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter...

[SECURITY] [DSA 898-1] New phpgroupware packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 898-1 [email protected] http://www.debian.org/security/ Martin Schulze November 17th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 898-1] New phpgroupware packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 898-1 [email protected] http://www.debian.org/security/ Martin Schulze November 17th, 2005 http://www.debian.org/security/faq -...

DSA-898-1 phpgroupware - programming errors

Bulletin has no description...

PhpGroupWare Multiple HTML Injection Vulnerabilities

PhpGroupWare is prone to multiple HTML injection vulnerabilities. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...