CVE-2005-4190

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4191

Multiple cross-site scripting XSS vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via 1 the tasklist's name or 2 description, when creating a new tasklist...

CVE-2005-4192

Multiple cross-site scripting XSS vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 the notepad's name or 2 description, when creating a new notepad...

CVE-2005-4192

Multiple cross-site scripting XSS vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 the notepad's name or 2 description, when creating a new notepad...

CVE-2005-4191

The CVE applies to Horde Nag Task List Manager H3, vulnerable in versions before 2.0.4 due to XSS in templates/tasklists/tasklists.inc (tasklist name/description). The root cause is cross‑site scripting in tasklists.inc, enabling remote authenticated users to inject arbitrary script/HTML when cre...

CVE-2005-4190

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4190

The CVE-2005-4190 issue affects Horde Application Framework prior to 3.0.8, introducing multiple cross-site scripting (XSS) vulnerabilities. Exploitation is possible via several input vectors (identity, Category/Label search, Mobile Phone, Date/Time fields) when importing CSV files and through mo...

CVE-2005-4189

CVE-2005-4189 covers multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 prior to 2.0.6. The issue arises from insufficient input sanitisation in several user-controllable fields (Calendar name when creating calendars; event title when deleting events; Category and Location ...

CVE-2005-4189

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...

CVE-2005-4192

CVE-2005-4192 affects Horde Mnemo Note Manager H3 prior to 2.0.3. The vulnerability is a cross-site scripting (XSS) flaw in templates/notepads/notepads.inc, allowing remote authenticated users to inject arbitrary script or HTML via the notepad name or description when creating a new notepad. Impa...

CVE-2005-4189: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...

CVE-2005-4190: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by 1 the identity field, 2 Category and 3 Label search fields, 4 the Mobile Phone field, and ...

CVE-2005-4192: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 the notepad's name or 2 description, when creating a new notepad...

SEC Consult SA-20051211-0 :: Several XSS issues in Horde Framework, Kronolith Calendar, Mnemo Notes, Nag Tasks and Turba Addressbook

SEC Consult Security Advisory 20051211-0 ========================================================================== title: Several XSS issues in Horde Framework, Kronolith Calendar, Mnemo Notes, Nag Tasks and Turba Addressbook program: Horde Application Framework + Modules vulnerable version:...

CVE-2005-4191: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via 1 the tasklist's name or 2 description, when creating a new tasklist...

horde -- Cross site scripting vulnerabilities in several of Horde's templates

Announce of Horde H3 3.0.8 final: This 3.0.8 is a security release that fixes cross site scripting vulnerabilities in several of Horde's templates. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Horde 3.0.7 upgrade to 3.0.8 ...

hordeGraphic.txt

Hello All, PRELUDE What is HORDE? http://www.horde.org/about/ The Mission The Horde Project is about creating high quality Open Source applications, based on PHP and the Horde Framework. The guiding principles of the Horde Project are to create solid standards-based applications using intelligent...

CVE-2005-4080

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...

CVE-2005-4080

Horde IMP 4.0.4 and earlier are vulnerable to cross-site scripting (XSS) due to failure to sanitize strings containing UTF-16 null characters. The issue allows remote attackers to craft UTF-16 encoded attachments/strings that execute when viewed in Internet Explorer (which ignores the null chars)...

CVE-2005-4080

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...