CVE-2017-15235

The File Manager gollem module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename...

CVE-2017-15235

The File Manager gollem module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename...

PT-2017-13924

Name of the Vulnerable Software and Affected Versions Horde Groupware version 5.2.21 with the File Manager gollem module 3.0.11 Description The issue allows remote attackers to bypass authentication for file downloads. This is achieved by using a crafted fn parameter that corresponds to the exact...

CVE-2017-15235: Direct Request

The File Manager gollem module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename...

Horde Groupware Unauthorized File Download

Vulnerability Summary The following advisory describes an unauthorized file download vulnerability found in Horde Groupware version 5.2.21. Horde Groupware Webmail Edition is “a free, enterprise ready, browser based communication suite. Users can read, send and organize email messages and manage...

[SECURITY] Fedora 26 Update: cyrus-imapd-3.0.3-1.fc26

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

Horde Groupware 5.2.21 - Unauthorized File Download

Vulnerability Summary The following advisory describes an unauthorized file download vulnerability found in Horde Groupware version 5.2.21. Horde Groupware Webmail Edition is “a free, enterprise ready, browser based communication suite. Users can read, send and organize email messages and manage...

Horde Groupware 5.2.21 - Unauthorized File Download

Horde Groupware 5.2.21 - Unauthorized File Download Vulnerability Summary The following advisory describes an unauthorized file download vulnerability found in Horde Groupware version 5.2.21. Horde Groupware Webmail Edition is “a free, enterprise ready, browser based communication suite. Users ca...

The vulnerability of the software for organizing collaborative work among users in Horde Groupware allows a hacker to break the encryption of emails.

The vulnerability of the Horde Groupware software for organizing collaborative work among users is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a malicious actor, who must act remotely and who is a verified user of Horde Webmail and has access to PG...

CVE-2017-9145

CVE-2017-9145 affects Tiki Wiki CMS Groupware (TikiFilter.php) across versions 12.x–16.x. The root cause is improper validation of the imgsize and lang parameters, enabling cross-site scripting (XSS). The vulnerability is documented with CVSS v3 base score 6.1 (MEDIUM) and CVSS v2 base score 4.3 ...

CVE-2017-9145: Improper Neutralization of Input During Web Page Generation

TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS...

Tiki Wiki CMS Groupware cross-site scripting vulnerability (CNVD-2017-11651)

Tiki Wiki CMS Groupware is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in the...

Design/Logic Flaw

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batchsendnewsletter.php...

CVE-2017-9305

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batchsendnewsletter.php...

CVE-2017-9305

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batchsendnewsletter.php...

CVE-2017-9305

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batchsendnewsletter.php...

PT-2017-18836

Name of the Vulnerable Software and Affected Versions Tiki Wiki CMS Groupware version 16.2 Description The issue allows remote attackers to bypass the XSS filter in Tiki Wiki CMS Groupware. This can be achieved by using padded zero characters. An example of an attack vector is tiki-batch send...

CVE-2017-9305: Improper Neutralization of Input During Web Page Generation

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batchsendnewsletter.php...

Horde Groupware Webmail Edition Operating System Command Injection Vulnerability

Horde Groupware Webmail Edition is a free enterprise browser based on the Communication Suite from Horde, Inc.HordeCrypt is an encryption/decryption library for working with PGP data. An OS command injection vulnerability exists in HordeCrypt versions prior to 2.7.6 used in Horde Groupware Webmai...

Horde Groupware Webmail Remote Command Execution Vulnerability

Horde Groupware Webmail is a product of Horde USA and is a free enterprise browser based on the Communication Suite. A remote code execution vulnerability exists in the file "/Horde/Crypt/Pgp/Backend/Binary.php" in Horde Groupware Webmail versions 3/4/5. An attacker can exploit this vulnerability...