Eroom Security Vulnerabilities - January

CVE-2005-2184

eRoom 6.x does not properly restrict files that can be attached, which allows remote attackers to execute arbitrary commands via a .lnk file.

CVE-2005-2185

eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks.