CVE-2005-2276

The embedded sources confirm CVE-2005-2276 affects Novell GroupWise WebAccess 6.5 (pre‑July 11, 2005). The vulnerability is a cross‑site scripting (XSS) flaw where an attacker can inject arbitrary script/HTML by sending an email containing an encoded javascript URI, e.g. j&#X41vascript in an IMG ...

CVE-2006-4220

Novell GroupWise WebAccess vulnerable to multiple XSS flaws in version before 7 Support Pack 3 Public Beta. Exploitation vectors involve crafted inputs in parameters (User.html, Error, User.Theme.index, User.lang) that allow remote attackers to inject arbitrary script/HTML. Root cause is cross-si...

CVE-2006-3817

CVE-2006-3817 is a cross-site scripting (XSS) vulnerability in Novell GroupWise WebAccess 6.5 and 7 prior to 20060727. The issue arises from improper handling of user-supplied input in email content encoded with UTF-7, allowing an attacker to inject and execute arbitrary script via a SCRIPT eleme...

CVE-2001-1233

Netware Enterprise Web Server 5.1 with GroupWise WebAccess 5.5 and NDS enabled is affected. The vulnerability allows remote attackers to enumerate usernames, group names and other system information by accessing ndsobj.nlm, due to exposure of directory information. CVSS v2.0 base score is 5.0 (AV...

CVE-2005-0296

CVE-2005-0296 affects Novell GroupWise WebAccess. The error handler allows unauthenticated remote reading of sensitive info (e.g., product version) via manipulated error or modify parameters that return template files or the about page. Vendor has disputed the issue. Connected sources provide no ...

CVE-2007-4557

CVE-2007-4557 is an XSS vulnerability in the Novell GroupWise 6.5 WebAccess webacc servlet. The issue allows remote attackers to inject arbitrary web script or HTML via the User.Id parameter, demonstrated by a URL within a STYLE element. The description notes this may be due to an incomplete fix ...

CVE-2006-3818

The CVE-2006-3818 entry describes a Cross-site scripting (XSS) flaw in Novell GroupWise WebAccess. Affected are WebAccess 6.5 prior to 20060721 and WebAccess 7 prior to 20060727, with the vulnerability exploitable via the GWAP.version parameter on the login page to inject arbitrary script/HTML. T...