CVE-2006-1491

Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer...

CVE-2006-1491

CVE-2006-1491 is a remote code execution vulnerability in the Horde Application Framework. The issue affects Horde 3.0.x before 3.0.10 and 3.1.x before 3.1.1, where unsanitized user input in the help viewer is passed to eval(), allowing arbitrary code execution on affected hosts. Related publicly...

CVE-2006-1491

Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer...

Horde Help Viewer Arbitrary Code Execution

The version of Horde installed on the remote host fails to sanitize user-supplied input before using it in the Help viewer to evaluate code. An unauthenticated attacker could exploit this flaw to execute arbitrary command on the remote host subject to the privileges of the web server user id...

Horde < 3.1.1 Help Viewer Code Execution

Binary data 3490.prm...

horde -- remote code execution vulnerability in the help viewer

Horde 3.1.1 release announcement: Major changes compared to Horde 3.1 are: Fix for remote code execution vulnerability in the help viewer, discovered by Jan Schneider from the Horde team...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

Code injection

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

CVE-2006-1260

The CVE-2006-1260 issue affects Horde Application Framework 3.0.9. A null character in the URL parameter of services/go.php bypasses a sanity check, allowing remote attackers to read arbitrary files (information disclosure). Multiple open-source advisories (SUSE, Debian, Gentoo/OpenVAS GLSA/DSA e...

CVE-2006-1260

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check...

[Full-disclosure] CodeScan Advisory: Unauthenticated Arbitrary File Read in Horde v3.09 and prior

======================================================================== = CodeScan Advisory, codescan.com [email protected] = = Unauthenticated Arbitrary File Read in Horde v3.09 and prior = = Vendor Website: = http://www.horde.org = = Affected Version: = Versions prior to and including...

Horde go.php url Parameter Arbitrary File Access

The version of Horde installed on the remote host fails to validate input to the 'url' parameter of the 'services/go.php' script before using it to read files and return their contents. An unauthenticated attacker may be able to leverage this issue to retrieve the contents of arbitrary files on t...

horde -- "url" disclosure of sensitive information vulnerability

Secunia advisory SA19246: Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information. Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile" call. This can be exploit...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242

CVE-2005-4242: The Horde Turba H3 2.0.4 and earlier are affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the address book or contact data. The OpenVAS entry references a FreeBSD port advisory noting the system n...

SEC-20051211-0.txt

SEC Consult Security Advisory ========================================================================== title: program: vulnerable version: homepage: found: by: / SEC Consult / www.sec-consult.com ========================================================================== ------------------- vend...

CVE-2005-4190

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4189

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...