Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2012-0791

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2012-0909

CVE-2012-0909 is an XSS in Horde_Form within Horde Groupware Webmail Edition prior to 4.0.6. Public records show fixes in Horde3 branch to 3.3.13 (openSUSE openSUSE-SU-2012:0286-1) and related security updates; remediation involves upgrading to Horde Groupware Webmail Edition 4.0.6 or newer, or H...

CVE-2012-0909

Cross-site scripting XSS vulnerability in HordeForm in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information...

CVE-2012-0909: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in HordeForm in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information...

CVE-2012-0791: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 composeCache, 2 rtemode, or 3 filename parameters to the compose page; 4 formname parameter to the...

CVE-2010-4778

Multiple cross-site scripting XSS vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the 1 username aka fmusername, 2 password aka fmpassword, or 3 server aka fmserver...

CVE-2010-3693

CVE-2010-3693 is an XSS vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5 and Horde Groupware Webmail Edition before 1.2.7. It allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names. The documents do not specify exploitation status or c...

CVE-2010-4778

Horde IMP prior to 4.3.8 and Horde Groupware Webmail Edition prior to 1.2.7 contain multiple XSS vulnerabilities in fetchmailprefs.php (fetchmail_prefs_save action). The issues allow remote attackers to inject arbitrary web script or HTML via vulnerable fields, specifically (for CVE-2010-4778) th...

CVE-2010-3693: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Horde Dynamic IMP DIMP before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names...

CVE-2010-4778: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the 1 username aka fmusername, 2 password aka fmpassword, or 3 server aka fmserver...

PT-2011-1431

Name of the Vulnerable Software and Affected Versions Horde Dynamic IMP DIMP versions prior to 1.1.5 Horde Groupware Webmail Edition versions prior to 1.2.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML, specifically when displaying...

PT-2011-1726

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 4.3.8 Horde Groupware Webmail Edition versions prior to 1.2.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the username aka fmusername, password aka fmpassword, or server...

CVE-2010-3695

CVE-2010-3695 is a cross-site scripting (XSS) vulnerability in Horde IMP (before 4.3.8) and Horde Groupware Webmail Edition (before 1.2.7). The flaw allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in the fetchmail_prefs_save action (Fetchmail configuration)....

PT-2011-1432

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 4.3.8 Horde Groupware Webmail Edition versions prior to 1.2.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the fm id parameter in a "fetchmail prefs save" action, related ...

CVE-2010-3695: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fmid parameter in a fetchmailprefssave action, related to the Fetchmail configuration...

CVE-2009-3701

Multiple cross-site scripting XSS vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1...

CVE-2009-3701

Multiple cross-site scripting XSS vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1...

CVE-2009-3701: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1...

CVE-2009-4363: Improper Neutralization of Input During Web Page Generation

TextFilter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting XSS attacks via data:text/html...