Novell has released updates for GroupWise 7 and 8 to address multiple vulnerabilities in GroupWise WebAccess and Internet Agents. These vulnerabilities may allow an attacker to execute arbitrary code, conduct cross-site scripting attacks, or obtain unauthorized access.

US-CERT encourages users and administrators to review the following Novell documents and apply any necessary updates to help mitigate the risks:

• Novell GroupWise WebAccess - Security Vulnerability with Javascript
• Novell GroupWise WebAccess - Scripting Security Vulnerability
• Novell GroupWise WebAccess - Cross Site Scripting (XSS) Security Vulnerability via Unfiltered Style Expressions
• Novell GroupWise WebAccess - Security Vulnerability in Session Management Mechanisms
• Novell GroupWise Internet Agent (GWIA) - Security Vulnerability in Email Address Processing
• Novell GroupWise Internet Agent (GWIA) - Security Vulnerability Processing SMTP Requests

Read more at: US-CERT Current Activity