CVE-2001-1258

Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...

CVE-2001-1258

CVE-2001-1258 affects the Horde IMP before 2.2.6. According to the Debian DSA-073-1 advisory and related sources, a hostile user who can place a publicly readable prefs.lang file on the Apache/PHP server can have that file executed as PHP code, enabling access to config data and potentially the H...

CVE-2001-1257: Undefined Security Weakness

Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...

CVE-2001-1258: Undefined Security Weakness

Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...

CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...

[SECURITY] [DSA-126-1] Horde and IMP cross-site scripting attack

Package : imp Problem type : cross-site scripting CSS Debian-specific: no A cross-site scripting CSS problem was discovered in Horde and IMP a web based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version...

Вставка скриптов в URL в Horde IMP (crossite scripting)

Вставив скрипт в URL можно получить доступ к сеансовым cookie...

Imp Webmail session hijacking vulnerability

It's possible to hijack an imp/horde session using a cross-site script attack, quite similar to the one explored by Marc Slemko in his "Microsoft Passport to Trouble" paper. - After hijacking the cookies, the attacker can use the session and read the victim's mail. - Imp...

Horde Imp Webmail status.php3 message Parameter XSS

The remote server is running IMP 2.2.7. Such versions are potentially affected by a cross-site scripting attack which can be used by an attacker to hijack a victim's IMP session. Nessus solely relied on the version number of your installation, so if you applied the hotfix already, consider this...

Horde IMP 2.2.x - Session Hijacking

source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to construct a link which when clicked wi...

Horde IMP 2.2.x - Session Hijacking

Horde IMP 2.2.x - Session Hijacking source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to...

CVE-2001-0744

Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file...

CVE-2001-0744

Summary: CVE-2001-0744 affects Horde IMP 2.2.4 and earlier. The vulnerability arises from a symlink attack on a temporary file that allows local users to overwrite files. The impact is limited to local integrity (partial) with no confidentiality or availability impact stated, according to the pro...

CVE-2001-0744

Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file...

CVE-2001-0744: Undefined Security Weakness

Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file...

Дырка в Horde IMP (code execution)

Неинициализированные PHP-переменные позволяют выполнение скрипта заданного атакующим. Кроме того есть другие уязвимости...

CVE-2001-1258

Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...

CVE-2001-1257

Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...

Horde 1.2.x/2.1.3 and Imp 2.2.x/3.1.2 - File Disclosure

source: https://www.securityfocus.com/bid/3067/info A vulnerability has been discovered in Horde Imp which may allow an attacker to access arbitrary system files. The issue occurs due to insufficient sanity checks on user-supplied URI parameters. By specifying a malicious INBOX file in a request,...

Horde 1.2.x2.1.3 and Imp 2.2.x3.1.2 - File Disclosure

Horde 1.2.x2.1.3 and Imp 2.2.x3.1.2 - File Disclosure source: https://www.securityfocus.com/bid/3067/info A vulnerability has been discovered in Horde Imp which may allow an attacker to access arbitrary system files. The issue occurs due to insufficient sanity checks on user-supplied URI...