SUSE CVE-2012-0909

Cross-site scripting XSS vulnerability in HordeForm in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information...

SUSE CVE-2012-5565

Cross-site scripting XSS vulnerability in js/compose-dimp.js in Horde Internet Mail Program IMP before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic vi...

SUSE CVE-2012-5567

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the 1 month, 2 monthlist, or ...

SUSE CVE-2012-6640

Cross-site scripting XSS vulnerability in Horde Internet Mail Program IMP before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565...

SUSE CVE-2013-1090

The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors...

SUSE CVE-2013-6365

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions...

SUSE CVE-2013-6364

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book...

SUSE CVE-2014-1691

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the formvars form...

SUSE CVE-2015-8807

Cross-site scripting XSS vulnerability in the renderVarInputnumber function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors...

SUSE CVE-2016-2228

Cross-site scripting XSS vulnerability in horde/templates/topbar/menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to...

SUSE CVE-2016-5303

Cross-site scripting XSS vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form 1 action or 2 xlink attribute...

SUSE CVE-2017-9773

Denial of Service was found in HordeImage 2.x before 2.5.0 via a crafted URL to the "Null" image driver...

SUSE CVE-2017-9774

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

Horde Groupware Command Injection (CVE-2017-7413)

A command injection vulnerability exists in Horde Groupware. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Horde Groupware Webmail Edition Insecure Deserialization (CVE-2022-30287)

An insecure deserialization vulnerability exists in Horde Groupware Webmail Edition. This vulnerability is due to improper input validation of the source parameter used for fetching an address book configuration...

The vulnerability of the create function in the Horde Webmail software allows a hacker to execute arbitrary code.

The vulnerability of the create function in the Horde Webmail software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Debian: Security Advisory (DLA-3090-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-3089-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3090-1] php-horde-turba security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3090-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 31, 2022 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3089-1] php-horde-mime-viewer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3089-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 31, 2022 https://wiki.debian.org/LTS -...