Vulnerabilities > Egroupware > Egroupware
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-09-22 | CVE-2010-3314 | Cross-Site Scripting vulnerability in Egroupware Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter. | 4.3 |
| 2010-09-22 | CVE-2010-3313 | Code Injection vulnerability in Egroupware phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters. | 7.5 |
| 2008-04-30 | CVE-2008-2041 | Code Injection vulnerability in Egroupware 1.4.001/1.4.002 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root. | 10.0 |
| 2008-03-25 | CVE-2008-1502 | Cross-Site Scripting vulnerability in multiple products The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. | 4.3 |
| 2007-09-26 | CVE-2007-5091 | Cross-Site Scripting vulnerability in Egroupware 1.4.001 Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.4.001 allow remote attackers to inject arbitrary web script or HTML via the cat_data[color] parameter to (1) preferences/inc/class.uicategories.inc.php and (2) admin/inc/class.uicategories.inc.php. | 4.3 |
| 2007-06-11 | CVE-2007-3155 | Multiple Unspecified vulnerability in EGroupWare WZ_ToolTips ADODB Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb. | 10.0 |
| 2007-06-11 | CVE-2007-3154 | Multiple Unspecified vulnerability in EGroupWare WZ_ToolTips ADODB Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors. | 10.0 |
| 2005-05-02 | CVE-2005-1203 | Cross-Site Scripting and SQL Injection vulnerability in eGroupWare Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter. | 7.5 |
| 2005-05-02 | CVE-2005-1202 | Cross-Site Scripting and SQL Injection vulnerability in eGroupWare Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php or (5) category_id parameter. network egroupware | 6.8 |
| 2005-05-02 | CVE-2005-1129 | Information Disclosure vulnerability in EGroupWare EMail Attachment eGroupWare 1.0.6 and earlier, when an e-mail is composed with an attachment but not sent, will send that attachment in the next e-mail, which may cause sensitive information to be sent to the wrong recipient. | 2.1 |