CVE-2008-0585

sysmgt.websm.webaccess in IBM AIX 5.2 and 5.3 has world writable permissions for unspecified WebSM Remote Client files, which allows local users to "alter the behavior of" this client by overwriting these files...

CVE-2006-4220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the 1 User.html, 2 Error, 3 User.Theme.index, and 4 and User.lang parameters...

Novell Groupwise 5.57e6.5.77.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities

Novell Groupwise 5.57e6.5.77.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/27582/info Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting...

Novell Groupwise 5.57e/6.5.7/7.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27582/info Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting these issues may allow an attacker to perform cross-site scripting attacks on unsuspectin...

Cross site scripting

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...

CVE-2007-4557

CVE-2007-4557 is an XSS vulnerability in the Novell GroupWise 6.5 WebAccess webacc servlet. The issue allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, demonstrated by a URL within a STYLE element. The description notes this may be due to an incomplete fix ...

CVE-2007-4557

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...

CVE-2007-4557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, as demonstrated by a URL within a url field in a STYLE element, possibly due to an incomplete fix for...

Novell Groupwise 6.5 Webaccess - User.Id Cross-Site Scripting

Novell Groupwise 6.5 Webaccess - User.Id Cross-Site Scripting source: https://www.securityfocus.com/bid/25126/info Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an...

Novell Groupwise 6.5 Webaccess - 'User.Id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25126/info Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting...

Novell GroupWise WebAccess base64_decode buffer overflow

Added: 04/25/2007 CVE: CVE-2007-2171 BID: 23556 OSVDB: 35018 Background Novell GroupWise includes a WebAccess service which allows users to access their e-mail using a web browser. Problem A buffer overflow in the base64decode function allows remote attackers to execute arbitrary commands by...

Novell GroupWise WebAccess base64_decode buffer overflow

Added: 04/25/2007 CVE: CVE-2007-2171 BID: 23556 OSVDB: 35018 Background Novell GroupWise includes a WebAccess service which allows users to access their e-mail using a web browser. Problem A buffer overflow in the base64decode function allows remote attackers to execute arbitrary commands by...

Novell GroupWise WebAccess base64_decode buffer overflow

Added: 04/25/2007 CVE: CVE-2007-2171 BID: 23556 OSVDB: 35018 Background Novell GroupWise includes a WebAccess service which allows users to access their e-mail using a web browser. Problem A buffer overflow in the base64decode function allows remote attackers to execute arbitrary commands by...

Novell GroupWise WebAccess base64_decode buffer overflow

Added: 04/25/2007 CVE: CVE-2007-2171 BID: 23556 OSVDB: 35018 Background Novell GroupWise includes a WebAccess service which allows users to access their e-mail using a web browser. Problem A buffer overflow in the base64decode function allows remote attackers to execute arbitrary commands by...

Stack overflow

Stack-based buffer overflow in the base64decode function in GWINTER.exe in Novell GroupWise GW WebAccess before 7.0 SP2 allows remote attackers to execute arbitrary code via long base64 content in an HTTP Basic Authentication request...

Immunity Canvas: GROUPWISE_WEBACCESS

Name| groupwisewebaccess ---|--- CVE| CVE-2007-2171 Exploit Pack| CANVAS Description| Novell GroupWise WebAccess Base64 Decoding Stack Overflow Notes| CVE Name: CVE-2007-2171 VENDOR: Novell VersionsAffected: Repeatability: References: http://www.zerodayinitiative.com/advisories/ZDI-07-015.html CV...

CVE-2007-2171

Summary: CVE-2007-2171 is a stack-based overflow in the base64_decode function of Novell GroupWise WebAccess, specifically in GWINTER.exe, exploited via overly long Base64 content in an HTTP Basic Authentication request. Affected product/component: Novell GroupWise WebAccess (GWINTER.exe) prior t...

Novell Groupwise WebAccess GWINTER.EXE Base64 Decoding Remote Overflow

The remote host is running a version of GroupWise WebAccess from Novell that is vulnerable to a stack overflow in the way it handles HTTP Basic Authentication. By sending a specially crafted request, an attacker can exploit this flaw to execute code on the remote host with administrative...

Novell Groupwise WebAccess GWINTER.EXE远程缓冲区溢出漏洞

Novell GroupWise是Novell基于WEB的应用服务程序。 Novell Groupwise WebAccess处理HTTP请求存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 问题存在于监听TCP 7205和7211的GWINTER.exe进程中，在处理HTTP BASIC验证请求时，拷贝用户提供的BASE64数据到固定大小的堆栈缓冲区，发送至少336字节会由于调用有漏洞的base64decode调用而造成基于堆栈的缓冲区溢出，可以应用程序权限执行任意指令。 Novell Groupwise 7.0 Novell Groupwise 7.0.0 SP1...

ZDI-07-015: Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability

ZDI-07-015: Novell Groupwise WebAccess Base64 Decoding Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-015.html April 18, 2007 -- CVE ID: CVE-2007-2171 -- Affected Vendor: Novell -- Affected Products: Groupwise WebAccess -- TippingPointTM IPS Customer Protection:...