[Full-disclosure] Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Horde IMP Webmail Client version H3 4.1.4 was released a few hours ago. It contains fixes for 2 XSS issues compared to 4.1.4 RC1. 1. Script injection through email subject lines in threaded view Subject lines of emails, when displayed in vulnerabl...

CVE-2006-4255

Cross-site scripting XSS vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolderlabel form field in the IMP search screen...

CVE-2006-4255

Cross-site scripting XSS vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolderlabel form field in the IMP search screen...

CVE-2006-4255

CVE-2006-4255 affects Horde IMP H3 before 4.1.3. The vulnerability is a Cross-Site Scripting (XSS) flaw in horde/imp/search.php, reported as injectible via multiple unspecified vectors related to folder names and the vfolder_label field in the IMP search screen. Affected component is the IMP webm...

CVE-2006-4255

Cross-site scripting XSS vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolderlabel form field in the IMP search screen...

CVE-2006-4255: Undefined Security Weakness

Cross-site scripting XSS vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolderlabel form field in the IMP search screen...

gollem, horde, imp, ingo, kronolith, mnemo, nag, turba security update

CentOS Errata and Security Advisory CESA-2006:0412-001 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2006-April/074970.html https://lists.centos.org/pipermail/centos-announce/2006-April/074971.html Affected packages: gollem-h3 horde imp-h3 ingo-h3...

CVE-2005-4080

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...

CVE-2005-4080

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...

CVE-2005-4080

Horde IMP 4.0.4 and earlier are vulnerable to cross-site scripting (XSS) due to failure to sanitize strings containing UTF-16 null characters. The issue allows remote attackers to craft UTF-16 encoded attachments/strings that execute when viewed in Internet Explorer (which ignores the null chars)...

Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection

source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be...

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...

Horde MIME Viewer vulnerability

Title : Cross-Site-Scripting Vulnerability in Horde IMP. Date : November 17, 2005 Product : Horde MIME Viewer 3.0.7 vulnerability Discovered by : Daniel Schreckling Overview ====================================================================== The Horde http://www.horde.org Project comprises a s...

IMP HTML MIME Viewer XSS Vulnerabilities

The target is running at least one instance of IMP whose version number is between 3.0 and 3.2.5 inclusive. Such versions are vulnerable to several XSS attacks when viewing HTML messages with the HTML MIME viewer and certain browsers. For additional information, see the 3.2.6 release announcement...

Horde and IMP test disclosure

The remote server is running Horde and/or IMP with test scripts available from the outside. The scripts may leak server-side information that is valuable to an attacker. OpenVAS Vulnerability Test $Id: hordetestdisclosure.nasl 6056 2017-05-02 09:02:50Z teissa $ Description: Horde and IMP test...

IMP_MIME_Viewer_html class XSS vulnerabilities

The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive. Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary Javascript code simply by reading an HTML message...

Horde < 3.2.2 IMP_MIME_Viewer_html class XSS Vulnerabilities

The remote server is running at least one instance of Horde IMP whose version number is between 3.0 and 3.2.1 inclusive. SPDX-FileCopyrightText: 2003-2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

IMP Detection

This script detects whether the remote host is running IMP and extracts version numbers and locations of any instances found. IMP is a PHP-based webmail package from The Horde Project that provides access to mail accounts via POP3 or IMAP. See http://www.horde.org/imp/ for more information. OpenV...

Horde IMP HTML MIME Viewer XSS Vulnerabilities

The target is running at least one instance of Horde IMP whose version number is between 3.0 and 3.2.5 inclusive. SPDX-FileCopyrightText: 2003-2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Horde Information Disclosure Vulnerability (Nov 2005) - Active Check

Horde is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2004 Sverre H. Huseby Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...