Groupwise
by Novell
CVEs (78)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-1330 | 0.00 | — | 0.01 | Mar 18, 2008 | Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker. | |||
| CVE-2007-3571 | 0.00 | — | 0.01 | Jul 5, 2007 | The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address. | |||
| CVE-2007-2513 | 0.00 | — | 0.01 | Jun 4, 2007 | Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack. | |||
| CVE-2006-4511 | 0.00 | — | 0.03 | Oct 5, 2006 | Messenger Agents (nmma.exe) in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted HTTP POST request to TCP port 8300 with a modified val parameter, which triggers a null dereference related to "zero-size strings in… | |||
| CVE-2006-3268 | 0.00 | — | 0.02 | Jun 29, 2006 | Unspecified vulnerability in the Windows Client API in Novell GroupWise 5.x through 7 might allow users to obtain "random programmatic access" to other email within the same post office. | |||
| CVE-2005-2620 | 0.00 | — | 0.02 | Aug 17, 2005 | grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory. | |||
| CVE-2005-2346 | 0.00 | — | 0.03 | Aug 3, 2005 | Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section. | |||
| CVE-2005-0296 | 0.00 | — | 0.03 | Jan 17, 2005 | NOTE: this issue has been disputed by the vendor. The error module in Novell GroupWise WebAccess allows remote attackers who have not authenticated to read potentially sensitive information, such as the version, via an incorrect login and a modified (1) error or (2) modify… | |||
| CVE-2004-2336 | 0.00 | — | 0.02 | Dec 31, 2004 | Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server. | |||
| CVE-2003-1551 | 0.00 | — | 0.02 | Dec 31, 2003 | Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script." | |||
| CVE-2002-1088 | 0.00 | — | 0.03 | Oct 4, 2002 | Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command. | |||
| CVE-2002-0341 | 0.00 | — | 0.01 | Jun 25, 2002 | GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter. | |||
| CVE-2002-0303 | 0.00 | — | 0.00 | May 31, 2002 | GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password. | |||
| CVE-2001-1458 | 0.00 | — | 0.04 | Oct 15, 2001 | Directory traversal vulnerability in Novell GroupWise 5.5 and 6.0 allows remote attackers to read arbitrary files via a request for /servlet/webacc?User.html= that contains "../" (dot dot) sequences and a null character. | |||
| CVE-2001-1232 | 0.00 | — | 0.02 | Aug 14, 2001 | GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get". | |||
| CVE-2001-1231 | 0.00 | — | 0.02 | Aug 14, 2001 | GroupWise 5.5 and 6 running in live remote or smart caching mode allows remote attackers to read arbitrary users' mailboxes by extracting usernames and passwords from sniffed network traffic, as addressed by the "Padlock" fix. | |||
| CVE-2001-0355 | 0.00 | — | 0.01 | Jun 27, 2001 | Novell Groupwise 5.5 (sp1 and sp2) allows a remote user to access arbitrary files via an implementation error in Groupwise system policies. | |||
| CVE-1999-1006 | 0.00 | — | 0.01 | Dec 19, 1999 | Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter. |
- CVE-2008-1330Mar 18, 2008risk 0.00cvss —epss 0.01
Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker.
- CVE-2007-3571Jul 5, 2007risk 0.00cvss —epss 0.01
The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
- CVE-2007-2513Jun 4, 2007risk 0.00cvss —epss 0.01
Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack.
- CVE-2006-4511Oct 5, 2006risk 0.00cvss —epss 0.03
Messenger Agents (nmma.exe) in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted HTTP POST request to TCP port 8300 with a modified val parameter, which triggers a null dereference related to "zero-size strings in…
- CVE-2006-3268Jun 29, 2006risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Windows Client API in Novell GroupWise 5.x through 7 might allow users to obtain "random programmatic access" to other email within the same post office.
- CVE-2005-2620Aug 17, 2005risk 0.00cvss —epss 0.02
grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory.
- CVE-2005-2346Aug 3, 2005risk 0.00cvss —epss 0.03
Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section.
- CVE-2005-0296Jan 17, 2005risk 0.00cvss —epss 0.03
NOTE: this issue has been disputed by the vendor. The error module in Novell GroupWise WebAccess allows remote attackers who have not authenticated to read potentially sensitive information, such as the version, via an incorrect login and a modified (1) error or (2) modify…
- CVE-2004-2336Dec 31, 2004risk 0.00cvss —epss 0.02
Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
- CVE-2003-1551Dec 31, 2003risk 0.00cvss —epss 0.02
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
- CVE-2002-1088Oct 4, 2002risk 0.00cvss —epss 0.03
Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command.
- CVE-2002-0341Jun 25, 2002risk 0.00cvss —epss 0.01
GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server via an HTTP request with an invalid HTMLVER parameter.
- CVE-2002-0303May 31, 2002risk 0.00cvss —epss 0.00
GroupWise 6, when using LDAP authentication and when Post Office has a blank username and password, allows attackers to gain privileges of other users by logging in without a password.
- CVE-2001-1458Oct 15, 2001risk 0.00cvss —epss 0.04
Directory traversal vulnerability in Novell GroupWise 5.5 and 6.0 allows remote attackers to read arbitrary files via a request for /servlet/webacc?User.html= that contains "../" (dot dot) sequences and a null character.
- CVE-2001-1232Aug 14, 2001risk 0.00cvss —epss 0.02
GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get".
- CVE-2001-1231Aug 14, 2001risk 0.00cvss —epss 0.02
GroupWise 5.5 and 6 running in live remote or smart caching mode allows remote attackers to read arbitrary users' mailboxes by extracting usernames and passwords from sniffed network traffic, as addressed by the "Padlock" fix.
- CVE-2001-0355Jun 27, 2001risk 0.00cvss —epss 0.01
Novell Groupwise 5.5 (sp1 and sp2) allows a remote user to access arbitrary files via an implementation error in Groupwise system policies.
- CVE-1999-1006Dec 19, 1999risk 0.00cvss —epss 0.01
Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter.
Page 4 of 4