CVE-2005-4080: Undefined Security Weakness

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...

GLSA-200511-20 : Horde Application Framework: XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200511-20 Horde Application Framework: XSS vulnerability The Horde Team reported a potential XSS vulnerability. Horde fails to properly escape error messages which may lead to displaying unsanitized error messages via...

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...

Horde IMP Webmail Client XSS all versions

Hello All, PRELUDE What is HORDE? http://www.horde.org/about/ The Mission The Horde Project is about creating high quality Open Source applications, based on PHP and the Horde Framework. The guiding principles of the Horde Project are to create solid standards-based applications using intelligent...

Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection

source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be...

Horde MIME Viewer vulnerability

Title : Cross-Site-Scripting Vulnerability in Horde IMP. Date : November 17, 2005 Product : Horde MIME Viewer 3.0.7 vulnerability Discovered by : Daniel Schreckling Overview ====================================================================== The Horde http://www.horde.org Project comprises a s...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3759

CVE-2005-3759: Horde webmail suite prior to 3.0.7 contains cross-site scripting vulnerabilities in the MIME viewers (gzip/tar and css) that do not filter/escape HTML when displaying attachments. Affected products include Horde up to 3.0.7; Debian/SUSE advisories reference Horde3 with fixes in 3.0...

CVE-2005-3759: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3570

Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The CVE-2005-3344 issue affects Horde Groupware/Horde3 where the default installation ships with an administrative account that has a blank password. This enables unauthenticated remote access to administrative functions, potentially compromising the system. Debian’s DSA-884-1 advisory fixes Hord...

CVE-2005-3570

CVE-2005-3570 affects Horde webmail/application framework versions prior to 2.2.9. The vulnerability arises from unescaped error messages, enabling a remote attacker to inject arbitrary scripts or HTML (XSS) via not properly escaped error messages. Technical references in connected documents conf...

CVE-2005-3344: Undefined Security Weakness

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3570: Improper Neutralization of Input During Web Page Generation

Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...

Horde Admin Account Default Password

The remote installation of horde uses an administrative account with no password. An attacker can leverage this issue to gain full control over the affected application and to run arbitrary shell, PHP, and SQL commands using the supplied admin utilities. Note that while the advisory is from Debia...