CVE-2004-0584

CVE-2004-0584 refers to an input validation vulnerability in Horde IMP up to version 3.2.3 (and earlier) that can allow remote attackers to inject script via HTML or script in email messages, potentially triggering a cross-site scripting (XSS) condition. Affected software: Horde IMP 3.2.3 and ear...

CVE-2004-0584

Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message, possibly triggering a cross-site scripting XSS vulnerability...

Horde Chora CVS Viewer diff Utility Arbitrary Command Execution

The remote server is running at least one instance of Chora version 1.2.1 or earlier. Such versions have a flaw in the diff viewer that enables a remote attacker to run arbitrary code with the permissions of the web user. %NASLMINLEVEL 70300 This script was written by George A. Theall, . See the...

Horde-IMP: Input validation vulnerability

Background Horde-IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. Description Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code. Impact By enticing a user to read a specially crafted...

CVE-2003-0728

Horde before 2.2.4 allows remote malicious web sites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL...

CVE-2003-0728

CVE-2003-0728 affects Horde before 2.2.4. The vulnerability allows remote malicious websites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL. The NVD entry lists a CVSSv2 base score of 6.4 (Medium) with network access, low attack complexity, and no u...

CVE-2003-0728

Horde before 2.2.4 allows remote malicious web sites to steal session IDs and read or create arbitrary email by stealing the ID from a referrer URL...

Horde IMP IMP_MIME_Viewer_html Class XSS

The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive. Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code simply by reading an HTML message...

Path Disclosure in Turba of Horde

There is a path disclosure in status.php of Turba module at Horde 2.1, you get this: Fatal error: Call to a member function on a non-object in /opt/local/apache/htdocs/horde/turba/status.php on line 12 NOTE: i observed that this only occur in Turba...

Horde test.php Direct Reqest Information Disclosure

The remote server is running Horde or a related project along with one or more test scripts. These scripts may leak server-side information that is valuable to an attacker. %NASLMINLEVEL 70300 This script was written by Sverre H. Huseby See the Nessus Scripts License for details Changes by Tenabl...

CVE-2002-0181

CVE-2002-0181 — Horde IMP status.php3 XSS is confirmed in connected OpenVAS/NVD entries. The vulnerability arises in the status.php3 parameter handling of IMP 2.2.8 and HORDE 1.2.7, where user-supplied data is not properly sanitized, enabling cross-site scripting and potential cookie theft when a...

CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...

Horde IMP mailbox.php3 Multiple Parameter SQL Injection

The remote server is running IMP, a web-based mail client. There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script. An attacker may use this flaw to gain unauthorized access to a user mailbox or...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

PT-2002-2745 · Horde · Horde Imp

Name of the Vulnerable Software and Affected Versions: Horde IMP version 2.2.7 Description: The issue allows remote attackers to obtain the full web root pathname via specific HTTP requests. This can be achieved by requesting certain files, including poppassd.php3, login.php3?reason=chpass2,...

CVE-2001-1258

CVE-2001-1258 affects the Horde IMP before 2.2.6. According to the Debian DSA-073-1 advisory and related sources, a hostile user who can place a publicly readable prefs.lang file on the Apache/PHP server can have that file executed as PHP code, enabling access to config data and potentially the H...

CVE-2001-1257

Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...

CVE-2001-1258

Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...

CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...

[SECURITY] [DSA-126-1] Horde and IMP cross-site scripting attack

Package : imp Problem type : cross-site scripting CSS Debian-specific: no A cross-site scripting CSS problem was discovered in Horde and IMP a web based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version...