Groupwise@6.5 Security Vulnerabilities and Issues — Groupwise@6.5 CVE List

Lucene search

NovellGroupwise6.5

24 matches found

CVE•added 2012/09/19 10:57 a.m.•124 views

CVE-2012-0271

Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as demonstrated by a requ...

10CVSS8.1AI score0.33258EPSS

CVE•added 2009/02/02 10:30 p.m.•62 views

CVE-2009-0272

Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors.

6.8CVSS7.2AI score0.00203EPSS

CVE•added 2009/02/02 10:30 p.m.•57 views

CVE-2009-0273

Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML...

4.3CVSS5.7AI score0.00888EPSS

CVE•added 2005/08/17 4:0 a.m.•53 views

CVE-2005-2620

grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory.

5CVSS6.5AI score0.01761EPSS

CVE•added 2011/01/31 8:0 p.m.•53 views

CVE-2010-4715

Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. NOTE: some of these details are obtained from third party information.

5CVSS6.9AI score0.03511EPSS

CVE•added 2005/08/03 4:0 a.m.•52 views

CVE-2005-2346

Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section.

7.5CVSS8.4AI score0.02053EPSS

CVE•added 2011/01/31 8:0 p.m.•51 views

CVE-2010-4712

Multiple stack-based buffer overflows in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a Content-Type header containing (1) multiple items separated by ; (semicolon) characters or (2) crafted string data.

10CVSS8AI score0.23212EPSS

CVE•added 2011/01/31 8:0 p.m.•48 views

CVE-2010-4711

Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.

10CVSS7.9AI score0.09387EPSS

CVE•added 2011/01/31 8:0 p.m.•48 views

CVE-2010-4717

Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command.

6.5CVSS8AI score0.23412EPSS

CVE•added 2007/07/05 7:30 p.m.•47 views

CVE-2007-3571

The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.

4.3CVSS6.2AI score0.00121EPSS

CVE•added 2006/06/29 5:5 p.m.•46 views

CVE-2006-3268

Unspecified vulnerability in the Windows Client API in Novell GroupWise 5.x through 7 might allow users to obtain "random programmatic access" to other email within the same post office.

5CVSS6.3AI score0.00983EPSS

CVE•added 2009/02/03 7:30 p.m.•46 views

CVE-2009-0410

Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.

10CVSS7.8AI score0.17503EPSS

CVE•added 2005/02/10 5:0 a.m.•45 views

CVE-2005-0296

NOTE: this issue has been disputed by the vendor. The error module in Novell GroupWise WebAccess allows remote attackers who have not authenticated to read potentially sensitive information, such as the version, via an incorrect login and a modified (1) error or (2) modify parameter that returns te...

5CVSS6.2AI score0.00842EPSS

CVE•added 2008/03/18 5:44 p.m.•45 views

CVE-2008-1330

Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker.

3.5CVSS6.1AI score0.00493EPSS

CVE•added 2011/01/28 9:0 p.m.•44 views

CVE-2010-4326

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, or (4) RRULE variable in this me...

10CVSS7.9AI score0.28492EPSS

CVE•added 2012/07/05 2:55 p.m.•44 views

CVE-2012-0410

Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.

5CVSS6.8AI score0.03832EPSS

CVE•added 2007/06/04 4:30 p.m.•43 views

CVE-2007-2513

Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack.

4.3CVSS6.6AI score0.02968EPSS

CVE•added 2011/01/28 9:0 p.m.•43 views

CVE-2010-4325

Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message.

10CVSS7.8AI score0.19925EPSS

CVE•added 2011/01/31 8:0 p.m.•43 views

CVE-2010-4713

Integer signedness error in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a signed integer value in the Content-Type header.

10CVSS7.8AI score0.1355EPSS

CVE•added 2013/04/19 11:44 a.m.•41 views

CVE-2013-1086

Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.

4.3CVSS5.8AI score0.02288EPSS

CVE•added 2013/07/15 8:55 p.m.•40 views

CVE-2013-1087

Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.

4.3CVSS5.9AI score0.02756EPSS

CVE•added 2009/02/03 7:30 p.m.•39 views

CVE-2009-0274

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests.

5CVSS6.3AI score0.00365EPSS

CVE•added 2011/01/31 8:0 p.m.•39 views

CVE-2010-4714

Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) gwpoa.exe in the Post Office Agent, (2) gwmta.exe in the Message Transfer Agent, (3) gwia.exe in the Internet Agent, (4) the WebAccess Agent, o...

10CVSS8AI score0.02518EPSS

CVE•added 2011/01/31 8:0 p.m.•34 views

CVE-2010-4716

Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.01774EPSS