Zarafa

zarafa

Vendor: Zarafa • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-28994 2Kopano Zarafa 2Groupware Core Zarafa Nov 21, 2024 Mar 31, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers.
CVE-2014-5448 1Zarafa 1Zarafa May 6, 2026 Oct 20, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
CVE-2014-5447 1Zarafa 2Webapp Zarafa May 6, 2026 Oct 20, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because...Show more Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.Show less
CVE-2014-0103 2Fedoraproject Zarafa 3Fedora WebappZarafa May 6, 2026 Jul 29, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.
CVE-2014-0079 1Zarafa 1Zarafa May 6, 2026 Apr 28, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors relat...Show more The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."Show less
CVE-2014-0037 1Zarafa 1Zarafa May 6, 2026 Apr 28, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."