CVE-2009-1635
published 2009-05-22CVE-2009-1635: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote…
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.91%
77.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
| novell | groupwise | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9q45-jm89-64q7: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7
ghsa_unreviewed·2022-05-02
CVE-2009-1635 [MEDIUM] CWE-79 GHSA-9q45-jm89-64q7: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
Red Hat
kernel: nfsv4: kernel panic in nfs4_proc_lock()
vendor_redhat·2008-10-22·CVSS 7.8
CVE-2009-3726 [HIGH] CWE-662 kernel: nfsv4: kernel panic in nfs4_proc_lock()
kernel: nfsv4: kernel panic in nfs4_proc_lock()
The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3 did not have support for NFSv4, and therefore is not affected by this issue. It was addressed in Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0474.html, https://rhn.redhat.com/errata/RHSA-2009-1670.html and https://rhn.redhat.com/errata/RHSA-2009-1635.html respectively.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txthttp://secunia.com/advisories/35177http://securitytracker.com/id?1022267http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1http://www.securityfocus.com/archive/1/503700/100/0/threadedhttp://www.securityfocus.com/archive/1/503885/100/0/threadedhttp://www.securityfocus.com/bid/35061http://www.securityfocus.com/bid/35066http://www.vupen.com/english/advisories/2009/1393https://bugzilla.novell.com/show_bug.cgi?id=472987https://bugzilla.novell.com/show_bug.cgi?id=474500https://bugzilla.novell.com/show_bug.cgi?id=484942https://exchange.xforce.ibmcloud.com/vulnerabilities/50672https://exchange.xforce.ibmcloud.com/vulnerabilities/50689https://exchange.xforce.ibmcloud.com/vulnerabilities/50691http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txthttp://secunia.com/advisories/35177http://securitytracker.com/id?1022267http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1http://www.securityfocus.com/archive/1/503700/100/0/threadedhttp://www.securityfocus.com/archive/1/503885/100/0/threadedhttp://www.securityfocus.com/bid/35061http://www.securityfocus.com/bid/35066http://www.vupen.com/english/advisories/2009/1393https://bugzilla.novell.com/show_bug.cgi?id=472987https://bugzilla.novell.com/show_bug.cgi?id=474500https://bugzilla.novell.com/show_bug.cgi?id=484942https://exchange.xforce.ibmcloud.com/vulnerabilities/50672https://exchange.xforce.ibmcloud.com/vulnerabilities/50689https://exchange.xforce.ibmcloud.com/vulnerabilities/50691
2009-05-22
Published