Lucene search

[email protected]CVE-2005-4189

HistoryDec 13, 2005 - 11:03 a.m.

CVE-2005-4189

2005-12-1311:03:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2005-4189

xss

vulnerabilities

horde kronolith h3

web script

html

authenticated users

calendar

event

category

location

attendees

nvd

5.4 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

71.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.

CPENameOperatorVersion
horde:kronolith_h3horde kronolith h3eq2.0_rc2
horde:kronolith_h3horde kronolith h3eq2.0_rc1
horde:kronolith_h3horde kronolith h3eq2.0.4
horde:kronolith_h3horde kronolith h3eq2.0
horde:kronolith_h3horde kronolith h3eq2.0.2_rc1
horde:kronolith_h3horde kronolith h3eq2.0.5
horde:kronolith_h3horde kronolith h3eq2.0_rc3
horde:kronolith_h3horde kronolith h3eq2.0.3
horde:kronolith_h3horde kronolith h3eq2.0.1
horde:kronolith_h3horde kronolith h3eq2.0.2

CPE	Name	Operator	Version
horde:kronolith_h3	horde kronolith h3	eq	2.0_rc2
horde:kronolith_h3	horde kronolith h3	eq	2.0_rc1
horde:kronolith_h3	horde kronolith h3	eq	2.0.4
horde:kronolith_h3	horde kronolith h3	eq	2.0
horde:kronolith_h3	horde kronolith h3	eq	2.0.2_rc1
horde:kronolith_h3	horde kronolith h3	eq	2.0.5
horde:kronolith_h3	horde kronolith h3	eq	2.0_rc3
horde:kronolith_h3	horde kronolith h3	eq	2.0.3
horde:kronolith_h3	horde kronolith h3	eq	2.0.1
horde:kronolith_h3	horde kronolith h3	eq	2.0.2

Rows per page:

1-10 of 141

References

archives.neohapsis.com/archives/fulldisclosure/2005-12/0459.html

lists.horde.org/archives/announce/2005/000234.html

secunia.com/advisories/17971

secunia.com/advisories/18827

www.debian.org/security/2006/dsa-970

www.osvdb.org/21608

www.osvdb.org/21609

www.osvdb.org/21610

www.osvdb.org/21611

www.sec-consult.com/245.html

www.securityfocus.com/bid/15808

www.vupen.com/english/advisories/2005/2834

5.4 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

71.4%

JSON

Related for CVE-2005-4189

openvas1 debian2 ubuntucve1 nessus1