Search criteria
12 vulnerabilities found for webapp by zarafa
FKIE_CVE-2014-9465
Vulnerability from fkie_nvd - Published: 2015-02-19 15:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
"matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
"matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zarafa:webapp:*:beta2:*:*:*:*:*:*",
"matchCriteriaId": "6A856DB8-7D8B-44F1-9222-869B91EBEAE6",
"versionEndIncluding": "2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "27064810-8639-4082-9B7C-F2E7B07A5338",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "665E9967-1FA2-4513-946D-E1E44FB52390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3E639AC0-D5B6-41BC-AAAD-54A3A28BEABB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F9284DC2-7AE5-4DEC-966C-A2A59926A775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "BF843A2F-3478-414E-8CE0-1166DEE4D6FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "34E3625A-90EC-4DF9-8D0E-AAB3996300A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3C98B24C-B67F-4908-AF6A-D69D879E677B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "24C9EA8C-0C44-4C72-94F5-8BFBA4604B9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "46CBFF6F-761D-400B-8BD7-412D8A47A407",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CEEFE371-9964-4510-8A34-C1D63B031DF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "FA2477AA-B97D-43E2-A3F3-4B03715D311C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "31F22097-C67F-45E0-B0D1-3E99BABFF943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "592C3C16-8786-43BA-B668-FD6EED305E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "5BD78668-9330-44AB-A922-720045B2988D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2F9CFB-6879-434A-9B6B-05C90534E8F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "249862F3-4BB2-4C51-8D82-7E5AAF00D245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CFAF932D-F390-44E8-8E73-7C8FEB06D6B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9B21E237-B31F-412A-A56F-9D2069A9D5D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B0412B21-DD63-4CC2-961E-D5A19E552029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C882F7FD-A474-4BC2-A4DA-92514452B20C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3EB31858-6696-40CE-8E67-2E1646532819",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "4AD82094-AC0F-4D1B-9C33-3F73A995CF35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B30109DB-097B-4ED9-958F-713D7ADCB760",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B5A990D2-F84A-49E8-96B9-F744F6B7B598",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5E4190B0-03BF-4A30-A311-63BC3E514582",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa_collaboration_platform:7.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "28E0C6E9-CB3F-488A-ADC8-7E1D31C90625",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files."
},
{
"lang": "es",
"value": "senddocument.php en Zarafa WebApp anterior a 2.0 beta 3 y WebAccess en Zarafa Collaboration Platform (ZCP) 7.x anterior a 7.1.12 beta 1 y 7.2.x anterior a 7.2.0 beta 1 permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de disco /tmp) mediante la subida de un n\u00famero grande de ficheros."
}
],
"id": "CVE-2014-9465",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-02-19T15:59:08.500",
"references": [
{
"source": "cve@mitre.org",
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"source": "cve@mitre.org",
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://jira.zarafa.com/browse/ZCP-12596"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-5449
Vulnerability from fkie_nvd - Published: 2014-10-20 15:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zarafa:webaccess:4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0289673C-04CB-474C-92C7-1C2011D4A05B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:webapp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A427A2D5-97A4-40C1-A587-E97A770CF0E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data."
},
{
"lang": "es",
"value": "Zarafa WebAccess 4.1 y WebApp utilizan permisos de lectura universal para los ficheros en su directorio tmp, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de datos de sesiones temporales."
}
],
"id": "CVE-2014-5449",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-10-20T15:55:04.967",
"references": [
{
"source": "cve@mitre.org",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q3/445"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/69369"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q3/445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/69369"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-5447
Vulnerability from fkie_nvd - Published: 2014-10-20 15:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zarafa:webapp:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F193EC-D724-4F9B-976E-E5F1D57ED3F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "15DE891E-A638-4374-99A4-E1F0154F4AD3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103."
},
{
"lang": "es",
"value": "Zarafa WebAccess 7.1.10 y WebApp 1.6 beta utilizan permisos (644) d\u00e9biles para config.php, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de los ficheros de las sesiones PHP. NOTA: esta vulnerabilidad existe debido a una soluci\u00f3n incompleta para CVE-2014-0103."
}
],
"id": "CVE-2014-5447",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-10-20T15:55:04.857",
"references": [
{
"source": "cve@mitre.org",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q3/445"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/69362"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q3/445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/69362"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-0103
Vulnerability from fkie_nvd - Published: 2014-07-29 14:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zarafa | webapp | * | |
| zarafa | zarafa | * | |
| zarafa | zarafa | 7.0 | |
| zarafa | zarafa | 7.0.1 | |
| zarafa | zarafa | 7.0.2 | |
| zarafa | zarafa | 7.0.3 | |
| zarafa | zarafa | 7.0.4 | |
| zarafa | zarafa | 7.0.5 | |
| zarafa | zarafa | 7.0.6 | |
| zarafa | zarafa | 7.0.7 | |
| zarafa | zarafa | 7.0.8 | |
| zarafa | zarafa | 7.0.9 | |
| zarafa | zarafa | 7.0.10 | |
| zarafa | zarafa | 7.0.11 | |
| zarafa | zarafa | 7.0.12 | |
| zarafa | zarafa | 7.0.13 | |
| zarafa | zarafa | 7.1.0 | |
| zarafa | zarafa | 7.1.1 | |
| zarafa | zarafa | 7.1.2 | |
| zarafa | zarafa | 7.1.3 | |
| zarafa | zarafa | 7.1.4 | |
| zarafa | zarafa | 7.1.8 | |
| fedoraproject | fedora | 19 | |
| fedoraproject | fedora | 20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zarafa:webapp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A4B27EE-B02D-421B-BD95-F2DB5C018D6D",
"versionEndIncluding": "1.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28C5C692-39F1-4E64-9190-889384405F90",
"versionEndIncluding": "7.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "ED156852-536D-4F1E-A0F6-AE56A3761B31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BB87FEAC-53F9-408A-ACC1-8E158C969D10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B3295CA-1249-486D-B8B5-BA8D3E51208E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20351915-0737-4116-A5FC-1A599CF4B58F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "ED8C5B3B-1A70-4C55-8883-C76B4E8B06E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "49114244-F5F6-4170-A774-C4464910C235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "CA8AC6BF-966E-4E2C-816C-8E0408371FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "83BBD25D-D9D3-4AEC-BCBD-AF71B1E83306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B8B82DCF-DBB2-4123-BC2C-CADA57D7BB5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B9593342-5727-4321-A3D1-106B53807F22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "169C423D-EC0F-4515-9D9F-5C836D317818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5918BF47-F84B-44AA-AC6F-2B6ABBDAF559",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "F9F7FACD-C812-44E7-AD6E-BDE0D7935C90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "562E0822-7D69-4CA0-BF45-90431B902C19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC4BF34-15BE-4ECE-B4F8-A0F89CEC134D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B616E103-E23C-472A-BF01-B135C7C9A91D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC44763E-0B6F-4F85-BFF4-443F8E8C1DB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "31107633-C2C7-45C6-AD29-C201FB9C91CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4E3B86A7-D99C-48D1-83A6-74C1B03C51A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zarafa:zarafa:7.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0735C7-4626-40F9-BD84-970C120FFA09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*",
"matchCriteriaId": "5991814D-CA77-4C25-90D2-DB542B17E0AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
"matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files."
},
{
"lang": "es",
"value": "WebAccess en Zarafa anterior a 7.1.10 y WebApp anterior a 1.6 almacena las credenciales en texto claro, lo que permite a usuarios locales de Apache obtener informaci\u00f3n sensible mediante la lectura de los ficheros PHP de sesi\u00f3n."
}
],
"id": "CVE-2014-0103",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-07-29T14:55:04.640",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/68247"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68247"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2014-9465 (GCVE-0-2014-9465)
Vulnerability from cvelistv5 – Published: 2015-02-19 15:00 – Updated: 2024-08-06 13:47
VLAI?
Summary
senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:47:41.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2015:040",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-04T20:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2015:040",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9465",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2015:040",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"name": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt",
"refsource": "CONFIRM",
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"name": "https://jira.zarafa.com/browse/ZCP-12596",
"refsource": "CONFIRM",
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"name": "http://security.robert-scheck.de/cve-2014-9465-zarafa/",
"refsource": "MISC",
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"name": "http://advisories.mageia.org/MGASA-2015-0049.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"name": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt",
"refsource": "CONFIRM",
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9465",
"datePublished": "2015-02-19T15:00:00",
"dateReserved": "2015-01-03T00:00:00",
"dateUpdated": "2024-08-06T13:47:41.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5449 (GCVE-0-2014-5449)
Vulnerability from cvelistv5 – Published: 2014-10-20 15:00 – Updated: 2024-08-06 11:48
VLAI?
Summary
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:48:48.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5449",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0380.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5449",
"datePublished": "2014-10-20T15:00:00",
"dateReserved": "2014-08-25T00:00:00",
"dateUpdated": "2024-08-06T11:48:48.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5447 (GCVE-0-2014-5447)
Vulnerability from cvelistv5 – Published: 2014-10-20 15:00 – Updated: 2024-08-06 11:48
VLAI?
Summary
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:48:48.404Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69362"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-31T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69362"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5447",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69362"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0380.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5447",
"datePublished": "2014-10-20T15:00:00",
"dateReserved": "2014-08-25T00:00:00",
"dateUpdated": "2024-08-06T11:48:48.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0103 (GCVE-0-2014-0103)
Vulnerability from cvelistv5 – Published: 2014-07-29 14:00 – Updated: 2024-08-06 09:05
VLAI?
Summary
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:39.021Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2014-7889",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
},
{
"name": "68247",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68247"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "FEDORA-2014-7896",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-31T13:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "FEDORA-2014-7889",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
},
{
"name": "68247",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68247"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "FEDORA-2014-7896",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0103",
"datePublished": "2014-07-29T14:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T09:05:39.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-9465 (GCVE-0-2014-9465)
Vulnerability from nvd – Published: 2015-02-19 15:00 – Updated: 2024-08-06 13:47
VLAI?
Summary
senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:47:41.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2015:040",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-04T20:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2015:040",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9465",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2015:040",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:040"
},
{
"name": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt",
"refsource": "CONFIRM",
"url": "http://download.zarafa.com/community/beta/7.1/changelog-7.1.txt"
},
{
"name": "[oss-security] 20150103 Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/01/03/10"
},
{
"name": "https://jira.zarafa.com/browse/ZCP-12596",
"refsource": "CONFIRM",
"url": "https://jira.zarafa.com/browse/ZCP-12596"
},
{
"name": "FEDORA-2015-5864",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156228.html"
},
{
"name": "http://security.robert-scheck.de/cve-2014-9465-zarafa/",
"refsource": "MISC",
"url": "http://security.robert-scheck.de/cve-2014-9465-zarafa/"
},
{
"name": "[oss-security] 20141207 CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2014/12/07/2"
},
{
"name": "FEDORA-2015-5823",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156112.html"
},
{
"name": "http://advisories.mageia.org/MGASA-2015-0049.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2015-0049.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139442"
},
{
"name": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt",
"refsource": "CONFIRM",
"url": "http://download.zarafa.com/community/beta/7.2/changelog-7.2.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9465",
"datePublished": "2015-02-19T15:00:00",
"dateReserved": "2015-01-03T00:00:00",
"dateUpdated": "2024-08-06T13:47:41.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5449 (GCVE-0-2014-5449)
Vulnerability from nvd – Published: 2014-10-20 15:00 – Updated: 2024-08-06 11:48
VLAI?
Summary
Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:48:48.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5449",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "webaccess-webapp-information-disc(95453)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95453"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0380.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "69369",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69369"
},
{
"name": "MDVSA-2014:182",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5449",
"datePublished": "2014-10-20T15:00:00",
"dateReserved": "2014-08-25T00:00:00",
"dateUpdated": "2024-08-06T11:48:48.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5447 (GCVE-0-2014-5447)
Vulnerability from nvd – Published: 2014-10-20 15:00 – Updated: 2024-08-06 11:48
VLAI?
Summary
Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:48:48.404Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69362"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-31T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69362"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5447",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140824 CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/444"
},
{
"name": "69362",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69362"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0380.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "MDVSA-2014:182",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
},
{
"name": "[oss-security] 20140825 Re: CVE request: Multiple incorrect default permissions in Zarafa",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/445"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5447",
"datePublished": "2014-10-20T15:00:00",
"dateReserved": "2014-08-25T00:00:00",
"dateUpdated": "2024-08-06T11:48:48.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0103 (GCVE-0-2014-0103)
Vulnerability from nvd – Published: 2014-07-29 14:00 – Updated: 2024-08-06 09:05
VLAI?
Summary
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:39.021Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2014-7889",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
},
{
"name": "68247",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68247"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "FEDORA-2014-7896",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-31T13:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "FEDORA-2014-7889",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136044.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1073618"
},
{
"name": "68247",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68247"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0380.html"
},
{
"name": "FEDORA-2014-7896",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/136033.html"
},
{
"name": "MDVSA-2014:182",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:182"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0103",
"datePublished": "2014-07-29T14:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T09:05:39.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}