PR08-21: Cross-site Request Forgery (CSRF) on Novell GroupWise WebAccess allows email theft and other attacks

PR08-21: Cross-site Request Forgery CSRF on Novell GroupWise WebAccess allows email theft and other attacks Vulnerability found: 3rd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: Critical Credits: Adrian Pastor of ProCheckUp Ltd...

PR08-22: Persistent XSS on Novell GroupWise WebAccess

PR08-22: Persistent XSS on Novell GroupWise WebAccess Vulnerability found: 2nd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: High Credits: Jan Fry of ProCheckUp Ltd www.procheckup.com. ProCheckUp thanks Novell for working with us in such a...

Cross site scripting

Cross-site scripting XSS vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3501

Cross-site scripting XSS vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3501: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Novell GroupWise WebAccess简易界面跨站脚本漏洞

BUGTRAQ ID: 29922 Novell GroupWise是一款跨平台协作软件。 WebAccess的简易用户界面没有正确地验证某些输入，远程攻击者可以通过提交恶意HTTP请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。标准WebAccess UI不受影响。 Novell Groupwise 7.x Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://download.novell.com/Download?buildid=ey8-Qy-Vwio...

CVE-2003-1551

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2003-1551 for any published specifics on affected products, impact, and remediation.

CVE-2003-1551

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."...

CVE-2003-1551: Undefined Security Weakness

Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."...

CVE-2006-4220

Multiple cross-site scripting XSS vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the 1 User.html, 2 Error, 3 User.Theme.index, and 4 and User.lang parameters...

CVE-2006-4220

Novell GroupWise WebAccess vulnerable to multiple XSS flaws in version before 7 Support Pack 3 Public Beta. Exploitation vectors involve crafted inputs in parameters (User.html, Error, User.Theme.index, User.lang) that allow remote attackers to inject arbitrary script/HTML. Root cause is cross-si...

CVE-2008-0585

sysmgt.websm.webaccess in IBM AIX 5.2 and 5.3 has world writable permissions for unspecified WebSM Remote Client files, which allows local users to "alter the behavior of" this client by overwriting these files...

CVE-2008-0585

The CVE affects IBM AIX 5.2 and 5.3, specifically the sysmgt.websm.webaccess component, where WebSM Remote Client files have world-writable permissions. This permits local users to alter the behavior of the client by overwriting those files. The issue is rooted in overly permissive file permissio...

CVE-2006-4220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the 1 User.html, 2 Error, 3 User.Theme.index, and 4 and User.lang parameters...

Novell Groupwise 5.57e6.5.77.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities

Novell Groupwise 5.57e6.5.77.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27582/info Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting...

Novell Groupwise 5.57e/6.5.7/7.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27582/info Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting these issues may allow an attacker to perform cross-site scripting attacks on unsuspectin...

Cross site scripting

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...

CVE-2007-4557

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...

CVE-2007-4557

CVE-2007-4557 is an XSS vulnerability in the Novell GroupWise 6.5 WebAccess webacc servlet. The issue allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, demonstrated by a URL within a STYLE element. The description notes this may be due to an incomplete fix ...

CVE-2007-4557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...