Vulnerabilities > Phpgroupware > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-05-19 | CVE-2010-0403 | Path Traversal vulnerability in PHPgroupware Directory traversal vulnerability in about.php in phpGroupWare (phpgw) before 0.9.16.016 allows remote attackers to include and execute arbitrary local files via a .. | 6.8 |
| 2009-12-24 | CVE-2009-4416 | Cross-Site Scripting vulnerability in PHPgroupware 0.9.16.12 Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence. | 4.3 |
| 2009-12-24 | CVE-2009-4414 | SQL Injection vulnerability in PHPgroupware 0.9.16.012 SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php. | 6.8 |
| 2006-08-31 | CVE-2006-4458 | Local File Include vulnerability in PHPgroupware 0.9.16.010 Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. | 6.4 |
| 2005-11-18 | CVE-2005-3347 | Path Traversal vulnerability in PHPgroupware 0.9.16 Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. | 6.8 |
| 2005-08-31 | CVE-2005-2761 | Unspecified vulnerability in PHPgroupware 0.9.16.000 Cross-site scripting (XSS) vulnerability in phpGroupWare 0.9.16.000 allows administrators to inject arbitrary web script or HTML by modifying the main screen message. network phpgroupware | 4.3 |
| 2004-12-31 | CVE-2004-2578 | Information Disclosure vulnerability in PHPGroupWare Plaintext Cookie Authentication Credentials phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords. | 5.0 |
| 2004-12-31 | CVE-2004-2577 | Unspecified vulnerability in PHPgroupware 0.9.16Rc1/0.9.16Rc2 The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts. | 5.0 |
| 2004-12-31 | CVE-2004-2576 | Information Disclosure vulnerability in PHPgroupware 0.9.16.000 class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files. | 5.0 |
| 2004-12-31 | CVE-2004-2575 | Information Disclosure vulnerability in Phpgroupware phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (2) hook_home.inc.php, (3) class.holidaycalc.inc.php, and (4) setup.inc.php.sample, which reveals the path in an error message. | 5.0 |