CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

UBUNTU-CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

CVE-2020-8035

Affected software: Horde Groupware Webmail Edition. Vulnerability: stored XSS via SVG image uploads, enabling a remote attacker to obtain access to a victim’s webmail account. Affected versions are Horde Groupware Webmail Edition prior to 5.2.22. Risk details are stated in the connected documents...

CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

CVE-2020-8035: Improper Neutralization of Input During Web Page Generation

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...

PT-2020-19932

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.22 Description The image view functionality is affected by a stored Cross-Site Scripting XSS issue via an SVG image upload containing a JavaScript payload. An attacker can obtain access to ...

CVE-2020-8034: Improper Neutralization of Input During Web Page Generation

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting XSS vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webma...

[SECURITY] Fedora 31 Update: php-horde-horde-5.2.22-1.fc31

The Horde Application Framework is a flexible, modular, general-purpose web application framework written in PHP. It provides an extensive array of components that are targeted at the common problems and tasks involved in developing modern web applications. It is the basis for a large number of...

[SECURITY] Fedora 30 Update: php-horde-horde-5.2.22-1.fc30

The Horde Application Framework is a flexible, modular, general-purpose web application framework written in PHP. It provides an extensive array of components that are targeted at the common problems and tasks involved in developing modern web applications. It is the basis for a large number of...

HANDYSOFT Handy Groupware Operating System Command Injection Vulnerability

HANDYSOFT Handy Groupware is an office collaboration solution from HANDYSOFT Korea. The product supports functions such as meeting management, attendance management and HR assessment. An operating system command injection vulnerability exists in ActiveX Control HShell.dll in HANDYSOFT Handy...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

Design/Logic Flaw

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2020-7804

CVE-2020-7804 affects Handy Groupware 1.7.3.1 on Windows 7/8/10 via ActiveX Control (HShell.dll). The root cause described is an ability for an attacker to execute arbitrary commands through the ShellExec method. No explicit remediation is provided in the supplied materials. Exploitation status a...

PT-2020-19801

Name of the Vulnerable Software and Affected Versions Handy Groupware version 1.7.3.1 Description The issue allows an attacker to execute arbitrary commands via the ShellExec method in the ActiveX Control HShell.dll. Recommendations For Handy Groupware version 1.7.3.1, consider disabling the...

CVE-2020-7804: Improper Neutralization of Special Elements used in an OS Command

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...