8 matches found
Horde Groupware Cross Site Scripting
Horde Groupware suffers from persistent cross site scripting and path traversal vulnerabilities. https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable together. for the sake of brevity ill write up on the stored xss one. in lib/Mime/Status.php, we see a...
CVE-2026-65053
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-65053
Horde IMP (webmail application) contains a stored cross-site scripting vulnerability in its AppleDouble MIME viewer. In lib/Mime/Viewer/Appledouble.php, the _IMPrender() method passes the MIME part's name parameter through sprintf into an IMP_Mime_Status object without escaping; IMP_Mime_Status::...
CVE-2026-65053
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
EUVD-2026-64899
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...