Groupwise@8.0 Security Vulnerabilities and Issues — Groupwise@8.0 CVE List

Lucene search

NovellGroupwise8.0

41 matches found

CVE•added 2013/02/24 4:37 a.m.•166 views

CVE-2013-0804

The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.

10CVSS7.9AI score0.3838EPSS

CVE•added 2012/03/02 10:55 p.m.•128 views

CVE-2011-4189

The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via a long e-mail address in an Address Book (aka .NAB) file.

7.5CVSS8AI score0.44338EPSS

CVE•added 2012/09/19 10:57 a.m.•124 views

CVE-2012-0271

Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as demonstrated by a requ...

10CVSS8.1AI score0.33258EPSS

CVE•added 2012/09/19 10:57 a.m.•119 views

CVE-2011-3827

The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.

4.3CVSS6.5AI score0.0365EPSS

CVE•added 2009/02/02 10:30 p.m.•62 views

CVE-2009-0272

Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors.

6.8CVSS7.2AI score0.00203EPSS

CVE•added 2011/01/28 10:0 p.m.•62 views

CVE-2010-2777

Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to execute arbitrary code via a long mailbox name in a CREATE command.

9CVSS8.1AI score0.24922EPSS

CVE•added 2009/05/26 3:30 p.m.•61 views

CVE-2009-1636

Multiple buffer overflows in the Internet Agent (aka GWIA) component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to execute arbitrary code via (1) a crafted e-mail address in an SMTP session or (2) an SMTP command.

10CVSS7.7AI score0.68138EPSS

CVE•added 2009/02/02 10:30 p.m.•57 views

CVE-2009-0273

Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML...

4.3CVSS5.7AI score0.00888EPSS

CVE•added 2013/02/24 4:37 a.m.•54 views

CVE-2012-0439

An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.

9.3CVSS7.7AI score0.68302EPSS

CVE•added 2011/01/31 8:0 p.m.•53 views

CVE-2010-4715

Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. NOTE: some of these details are obtained from third party information.

5CVSS6.9AI score0.03511EPSS

CVE•added 2011/01/31 8:0 p.m.•51 views

CVE-2010-4712

Multiple stack-based buffer overflows in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a Content-Type header containing (1) multiple items separated by ; (semicolon) characters or (2) crafted string data.

10CVSS8AI score0.23212EPSS

CVE•added 2009/05/22 4:48 p.m.•50 views

CVE-2009-1635

Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a m...

4.3CVSS5.6AI score0.00398EPSS

CVE•added 2011/01/28 10:0 p.m.•49 views

CVE-2010-2778

Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to a "Javascript XSS exploit."

4.3CVSS5.2AI score0.0173EPSS

CVE•added 2011/10/08 2:52 a.m.•49 views

CVE-2011-0333

Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message, related to a...

10CVSS8.1AI score0.08492EPSS

CVE•added 2011/10/08 2:52 a.m.•49 views

CVE-2011-0334

Stack-based buffer overflow in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a long HTTP request for a .css file.

10CVSS8.2AI score0.25116EPSS

CVE•added 2011/01/31 8:0 p.m.•48 views

CVE-2010-4711

Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.

10CVSS7.9AI score0.09387EPSS

CVE•added 2011/01/31 8:0 p.m.•48 views

CVE-2010-4717

Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command.

6.5CVSS8AI score0.23412EPSS

CVE•added 2011/10/08 2:52 a.m.•48 views

CVE-2011-2218

Unspecified vulnerability in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, a different vulnerability than CVE-2011-2219.

5CVSS6.7AI score0.01731EPSS

CVE•added 2012/09/28 10:40 a.m.•47 views

CVE-2012-0418

Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file.

9.3CVSS7.7AI score0.06305EPSS

CVE•added 2009/02/03 7:30 p.m.•46 views

CVE-2009-0410

Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.

10CVSS7.8AI score0.17503EPSS

CVE•added 2012/09/28 10:40 a.m.•45 views

CVE-2012-4912

Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message.

4.3CVSS5.8AI score0.01433EPSS

CVE•added 2011/01/28 9:0 p.m.•44 views

CVE-2010-4326

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, or (4) RRULE variable in this me...

10CVSS7.9AI score0.28492EPSS

CVE•added 2011/10/08 2:52 a.m.•44 views

CVE-2011-2662

Integer signedness error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message.

10CVSS7.7AI score0.16726EPSS

CVE•added 2012/07/05 2:55 p.m.•44 views

CVE-2012-0410

Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.

5CVSS6.8AI score0.03832EPSS

CVE•added 2011/01/28 9:0 p.m.•43 views

CVE-2010-4325

Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message.

10CVSS7.8AI score0.19925EPSS

CVE•added 2011/01/31 8:0 p.m.•43 views

CVE-2010-4713

Integer signedness error in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a signed integer value in the Content-Type header.

10CVSS7.8AI score0.1355EPSS

CVE•added 2011/10/08 2:52 a.m.•43 views

CVE-2011-2219

5CVSS6.7AI score0.01731EPSS

CVE•added 2012/09/28 10:40 a.m.•43 views

CVE-2012-0419

Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request.

5CVSS6.7AI score0.78808EPSS

CVE•added 2014/09/05 1:55 a.m.•42 views

CVE-2014-0610

The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

10CVSS8.1AI score0.07006EPSS

CVE•added 2009/05/26 3:30 p.m.•41 views

CVE-2009-1634

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors.

7.5CVSS7.1AI score0.04944EPSS

CVE•added 2011/01/28 10:0 p.m.•41 views

CVE-2010-2779

Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to "replies."

4.3CVSS5.8AI score0.0173EPSS

CVE•added 2011/10/08 2:52 a.m.•41 views

CVE-2011-2661

Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the (1) Directory.Item.name or (2) Directory.Item.displayName parameter.

4.3CVSS5.9AI score0.0062EPSS

CVE•added 2013/04/19 11:44 a.m.•41 views

CVE-2013-1086

Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.

4.3CVSS5.8AI score0.02288EPSS

CVE•added 2011/10/08 2:52 a.m.•40 views

CVE-2011-2663

Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.

10CVSS7.6AI score0.06254EPSS

CVE•added 2012/09/19 10:57 a.m.•40 views

CVE-2012-0272

Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter.

4.3CVSS5.9AI score0.00673EPSS

CVE•added 2012/09/28 10:40 a.m.•40 views

CVE-2012-0417

Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.

10CVSS8.2AI score0.0623EPSS

CVE•added 2013/07/15 8:55 p.m.•40 views

CVE-2013-1087

Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.

4.3CVSS5.9AI score0.02756EPSS

CVE•added 2009/02/03 7:30 p.m.•39 views

CVE-2009-0274

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests.

5CVSS6.3AI score0.00365EPSS

CVE•added 2011/01/31 8:0 p.m.•39 views

CVE-2010-4714

Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) gwpoa.exe in the Post Office Agent, (2) gwmta.exe in the Message Transfer Agent, (3) gwia.exe in the Internet Agent, (4) the WebAccess Agent, o...

10CVSS8AI score0.02518EPSS

CVE•added 2010/03/03 8:30 p.m.•38 views

CVE-2009-4662

Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 7.0 before 7.03 HP4 and 8.0 before 8.0 SP1 allows remote attackers to inject arbitrary web script or HTML via the User.Theme.index parameter.

4.3CVSS5.9AI score0.00884EPSS

CVE•added 2011/01/31 8:0 p.m.•34 views

CVE-2010-4716

Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.01774EPSS