137 matches found
Debian: Security Advisory (DSA-1829-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 1829-2] New sork-passwd-h3 packages fix regression
------------------------------------------------------------------------ Debian Security Advisory DSA-1829-2 [email protected] http://www.debian.org/security/ Steffen Joeris July 14, 2009 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1829-1] New sork-passwd-h3 packages fix cross-site scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1829-1 [email protected] http://www.debian.org/security/ Steffen Joeris July 11, 2009 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1829-1] New sork-passwd-h3 packages fix cross-site scripting
------------------------------------------------------------------------ Debian Security Advisory DSA-1829-1 [email protected] http://www.debian.org/security/ Steffen Joeris July 11, 2009 http://www.debian.org/security/faq -...
CVE-2008-6746
Cross-site scripting XSS vulnerability in the contact display view in Turba Contact Manager H3 before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the contact name...
Gentoo Security Advisory GLSA 200611-22 (horde-ingo)
The remote host is missing updates announced in advisory GLSA 200611-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
CVE-2008-4182
The CVE-2008-4182 issue affects Horde Turba Contact Manager (imp/test.php) in Turba 2.2.1 and earlier than 2.3.1, enabling a remote XSS via the User field in an IMAP session. Public documents confirm this cross-site scripting in Turba/imp/test.php and indicate fixes in Turba 2.3 (e.g., Fedora tur...
CVE-2008-0807
lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...
Design/Logic Flaw
lib/Driver/sql.php in Turba 2 turba2 Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify...
Unfixed XSS vulnerability at h3.netster.com
Security researcher Uber0n, has submitted on 01/07/2008 a cross-site-scripting XSS vulnerability affecting h3.netster.com, which at the time of submission ranked 33018 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2008. It is currently...
CVE-2007-1515
Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...
CVE-2007-1515
Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...
CVE-2007-1515
CVE-2007-1515 relates to multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3 (and possibly earlier). The NVD description indicates that remote attackers could inject arbitrary scripts via (1) the email Subject header in thread.php and (2) the edit_query parameter in search.p...
[Full-disclosure] Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Horde IMP Webmail Client version H3 4.1.4 was released a few hours ago. It contains fixes for 2 XSS issues compared to 4.1.4 RC1. 1. Script injection through email subject lines in threaded view Subject lines of emails, when displayed in vulnerabl...
CVE-2006-6175
Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to include arbitrary files and execute PHP code via a .. dot dot sequence in the view parameter...
CVE-2006-6175
CVE-2006-6175 affects Horde Kronolith (lib/FBView.php) where a raw unfiltered string enables directory traversal with a .. sequence in the view parameter, allowing an authenticated or remote attacker to include arbitrary files and execute PHP code. Affected: Kronolith H3 < 2.0.7 and Kronolith ...
Ingo H3: Folder name shell command injection
Background Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and IMAP filter rules. Description Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact A remote authenticated attacker could craft a malicious rule which could lead to the execution of...
GLSA-200611-22 : Ingo H3: Folder name shell command injection
The remote host is affected by the vulnerability described in GLSA-200611-22 Ingo H3: Folder name shell command injection Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact : A remote authenticated attacker could craft a malicious rule which could lead to the executio...