[SECURITY] [DSA 1560-1] New kronolith2 packages fix cross site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1560-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst April 28, 2008 http://www.debian.org/security/faq -...

CVE-2008-1974

Cross-site scripting XSS vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2008-1974

Cross-site scripting XSS vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2008-1974

CVE-2008-1974 is an XSS vulnerability in Horde Kronolith (Kronolith 2.1.x and Groupware variants) where the url parameter in addevent.php can inject arbitrary script/HTML. The issue is reported as insufficient input sanitisation in Kronolith’s add-event flow, allowing remote attackers to execute ...

Horde Webmail 1.0.6 - addevent.php Cross-Site Scripting

Horde Webmail 1.0.6 - addevent.php Cross-Site Scripting source: https://www.securityfocus.com/bid/28898/info Horde Webmail is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute ...

Horde Webmail 1.0.6 - 'addevent.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/28898/info Horde Webmail is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowin...

hordemail-xss.txt

Aria-Security Team Persian Security Network http://Aria-Security.com & http://Aria-Security.net ---------------------------------------------------------- Greetz: AurA, imm02tal, Mormoroth ,NULL, Kinglet http://www.horde.org/...

Fedora 8 : kronolith-2.1.7-1.fc8 (2008-2221)

Fix privilege escalation in Horde API. Fix missing ownership validation on share changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 7 : kronolith-2.1.7-1.fc7 (2008-2212)

Fix privilege escalation in Horde API. Fix missing ownership validation on share changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

[SECURITY] Fedora 7 Update: kronolith-2.1.7-1.fc7

Kronolith is the Horde calendar application. It provides repeating events, all-day events, custom fields, keywords, and managing multiple users through Horde Authentication. The calendar API that Kronolith uses is abstracted; MCAL and SQL drivers are currently provided. The Horde Project writes w...

Debian: Security Advisory (DSA-970-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 970-1 (kronolith)

The remote host is missing an update to kronolith announced via advisory DSA 970-1. Johannes Greil of SEC Consult discovered several cross-site scripting vulnerabilities in kronolith, the Horde calendar application. The old stable distribution woody does not contain kronolith packages. OpenVAS...

GLSA-200701-11 : Kronolith: Local file inclusion

The remote host is affected by the vulnerability described in GLSA-200701-11 Kronolith: Local file inclusion Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered string is used instead of a sanitized string to view local files. Impact : An authenticated attacker could craft an...

Kronolith: Local file inclusion

Background Kronolith is a web-based calendar which relies on the Horde Framework for integration with other applications. Description Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered string is used instead of a sanitized string to view local files. Impact An authenticated...

CVE-2006-6175

Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to include arbitrary files and execute PHP code via a .. dot dot sequence in the view parameter...

CVE-2006-6175

CVE-2006-6175 affects Horde Kronolith (lib/FBView.php) where a raw unfiltered string enables directory traversal with a .. sequence in the view parameter, allowing an authenticated or remote attacker to include arbitrary files and execute PHP code. Affected: Kronolith H3 < 2.0.7 and Kronolith ...

FreeBSD : kronolith -- arbitrary local file inclusion vulnerability (a8af7d70-8007-11db-b280-0008743bf21a)

iDefense Labs reports : Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server. The vulnerability specifically exists due to a design error in the way it includes...

iDefense Security Advisory 11.29.06: Horde Kronolith Arbitrary Local File Inclusion Vulnerability

Horde Kronolith Arbitrary Local File Inclusion Vulnerability iDefense Security Advisory 11.27.06 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 27, 2006 I. BACKGROUND Kronolith is a web-based calendar system written in PHP and utilizing the Horde Application Framework. It is generally...

kronolith -- arbitrary local file inclusion vulnerability

iDefense Labs reports: Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server. The vulnerability specifically exists due to a design error in the way it includes certa...

Debian DSA-970-1 : kronolith - missing input sanitising

Johannes Greil of SEC Consult discovered several cross-site scripting vulnerabilities in kronolith, the Horde calendar application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-970. The...