Code injection

The web login functionality c/portal/login in Novell Teaming 1.0 through SP3 1.0.3 generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 ppstate or 2 ppmode parameters...

CVE-2009-1293

The CVE-2009-1293 issue affects Novell Teaming 1.0–SP3 (1.0.3) web login (c/portal/login). The vulnerability enables remote user enumeration because the login responses differ for valid versus invalid usernames. Nessus also notes a likely related cross-site scripting risk due to unsanitized p_p_s...

CVE-2009-1294

CVE-2009-1294 affects Novell Teaming 1.0 up to SP3 (1.0.3) with XSS in web/guest/home, caused by improper validation/escaping of p_p_state and p_p_mode parameters. Remote attackers can inject arbitrary scripts; impact is web-page script execution. Public details reference Liferay 4.3.0 portal con...

CVE-2009-1293

The web login functionality c/portal/login in Novell Teaming 1.0 through SP3 1.0.3 generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

CVE-2009-1294

Multiple cross-site scripting XSS vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 ppstate or 2 ppmode parameters...

Novell Teaming用户枚举和跨站脚本漏洞

BUGTRAQ ID: 34531 CVECAN ID: CVE-2009-1294,CVE-2009-1293 Novell Teaming是专为团队协同作业而设计的解决方案，内含各种企业社区网络与工作流程功能。 Novell Teaming通过以下登录表单执行用户认证： https://teaming.example.com/c/portal/login 对于有效的和无效的用户名，Web应用会返回不同的响应（Please enter a valid login/Auhtentication failed），这就允许攻击者通过字典或暴力猜测攻击推测出是否存在特定的用户名。 Novell...

CVE-2009-1293: Exposure of Sensitive Information to an Unauthorized Actor

The web login functionality c/portal/login in Novell Teaming 1.0 through SP3 1.0.3 generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames...

Novell Teaming Enumeration / XSS

SEC Consult Security Advisory ========================================================================== title: Novell Teaming Multiple Vulnerabilities Username Enumeration Multiple Cross Site Scripting Includes vulnerable Liferay portal program: Novell Teaming vulnerable version: 1.0.3 homepage:...

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34531/info Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities. A remote attacker can exploit the user-enumeration...

Novell Teaming 1.0 - User Enumeration / Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/34531/info Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities. A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attac...