debian/gosa vulnerabilities

Latest debian/gosa CVEs

Newest publication first

1. CVE-2019-14466 The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user acc...

   Published 2019-12-31

   Medium·CVSS 6.5 EPSS 1.2%

   The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize i...

2. DLA-1905-1 gosa - security update

   Published 2019-08-31

   Unknown

3. CVE-2019-11187 Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arb...

   Published 2019-08-15

   Critical·CVSS 9.8 EPSS 1.7%

   Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.

4. DLA-1876-1 gosa - security update

   Published 2019-08-10

   Unknown

5. DLA-1436-1 gosa - security update

   Published 2018-07-21

   Unknown

6. DSA-4239-1 gosa - security update

   Published 2018-07-03

   Unknown

7. CVE-2018-1000528 GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in inj...

   Published 2018-06-26

   Medium·CVSS 6.1 EPSS 46.1%

   GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via...

8. CVE-2015-8771 The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.

   Published 2017-02-13

   Critical·CVSS 9.8 EPSS 2.4%

   The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.

9. CVE-2014-9760 Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.

   Published 2017-02-13

   Medium·CVSS 6.1 EPSS 1.2%

   Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.

10. DLA-562-1 gosa - security update

    Published 2016-07-26

    Unknown

11. DLA-408-1 gosa - security update

    Published 2016-01-31

    Unknown

12. DLA-115-2 gosa - regression update

    Published 2015-03-11

    Unknown

13. DLA-115-1 gosa - security update

    Published 2014-12-18

    Unknown

14. CVE-2007-0313 Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests.

    Published 2007-01-18

    High·CVSS 9.0 EPSS 1.9%

    Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.