Horde Imp < 4.1.6 Multiple Vulnerabilities

Binary data 4338.prm...

Directory traversal

Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in 1 errorhandlerfile and 2 localphp parameters to a tiki-index.php, or 3 encoded "..%2F" sequences in the implanguage parameter to...

CVE-2007-5684

Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in 1 errorhandlerfile and 2 localphp parameters to a tiki-index.php, or 3 encoded "..%2F" sequences in the implanguage parameter to...

CVE-2007-1679

The CVE-2007-1679 entry concerns multiple XSS vulnerabilities in Horde Groupware Webmail 1.0, specifically in imp/search.php and ingo/rule.php. The issue is that remote authenticated users can inject script/HTML via unspecified vectors; however, the vendor disputes the existence of the search.php...

CVE-2007-1679: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in 1 imp/search.php and 2 ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php...

PT-2007-3049 · Horde · Horde Groupware Webmail

Name of the Vulnerable Software and Affected Versions: Horde Groupware Webmail version 1.0 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1515

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1515

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1515

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1515

CVE-2007-1515 relates to multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3 (and possibly earlier). The NVD description indicates that remote attackers could inject arbitrary scripts via (1) the email Subject header in thread.php and (2) the edit_query parameter in search.p...

CVE-2007-1515: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

Design/Logic Flaw

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

CVE-2007-1474

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

CVE-2007-1474

CVE-2007-1474 affects Horde Project Horde and IMP prior to Horde Application Framework 3.1.4. The vulnerability is an argument injection flaw in the cleanup cron script that can let local users delete arbitrary files and potentially gain privileges by supplying multiple space-delimited pathnames....

CVE-2007-1474: Undefined Security Weakness

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/22975/info Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails...

Horde Framework and IMP 2.x3.x - Cleanup Cron Script Arbitrary File Deletion

Horde Framework and IMP 2.x3.x - Cleanup Cron Script Arbitrary File Deletion source: https://www.securityfocus.com/bid/22985/info Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application. A...

Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion

source: https://www.securityfocus.com/bid/22985/info Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application. A successful attack can reduce the integrity of affected computers and may aid in...

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/22975/info Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and scrip...