CVE-2007-1515: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

[Full-disclosure] Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Horde IMP Webmail Client version H3 4.1.4 was released a few hours ago. It contains fixes for 2 XSS issues compared to 4.1.4 RC1. 1. Script injection through email subject lines in threaded view Subject lines of emails, when displayed in vulnerabl...

CVE-2006-6175

Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to include arbitrary files and execute PHP code via a .. dot dot sequence in the view parameter...

CVE-2006-6175

CVE-2006-6175 affects Horde Kronolith (lib/FBView.php) where a raw unfiltered string enables directory traversal with a .. sequence in the view parameter, allowing an authenticated or remote attacker to include arbitrary files and execute PHP code. Affected: Kronolith H3 < 2.0.7 and Kronolith ...

Ingo H3: Folder name shell command injection

Background Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and IMAP filter rules. Description Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact A remote authenticated attacker could craft a malicious rule which could lead to the execution of...

GLSA-200611-22 : Ingo H3: Folder name shell command injection

The remote host is affected by the vulnerability described in GLSA-200611-22 Ingo H3: Folder name shell command injection Ingo H3 fails to properly escape shell metacharacters in procmail rules. Impact : A remote authenticated attacker could craft a malicious rule which could lead to the executio...

CVE-2006-5449

procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule...

CVE-2006-5449

procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule...

CVE-2006-5449

CVE-2006-5449 affects Ingo H3 (Horde module) and allows remote authenticated users to execute arbitrary shell commands via metacharacters in the mailbox destination of a filter rule. The issue arises from inadequate escaping in procmail rule generation. Affected software is Ingo H3 up to version ...

CVE-2006-5449: Undefined Security Weakness

procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule...

CVE-2006-4255

Cross-site scripting XSS vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolderlabel form field in the IMP search screen...

CVE-2006-4255

CVE-2006-4255 affects Horde IMP H3 before 4.1.3. The vulnerability is a Cross-Site Scripting (XSS) flaw in horde/imp/search.php, reported as injectible via multiple unspecified vectors related to folder names and the vfolder_label field in the IMP search screen. Affected component is the IMP webm...

FreeBSD : nag -- XSS vulnerabilities in several of the tasklist name and task data fields (ee6b5956-6a89-11da-b96e-000fb586ba73)

Announce of Nag H3 2.0.4 final : This 2.0.4 is a security release that fixes cross site scripting vulnerabilities in several of the tasklist name and task data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Nag 2.0.3...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4242

CVE-2005-4242: The Horde Turba H3 2.0.4 and earlier are affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the address book or contact data. The OpenVAS entry references a FreeBSD port advisory noting the system n...

CVE-2005-4242: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the address book and 2 contact data...

CVE-2005-4192

Multiple cross-site scripting XSS vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 the notepad's name or 2 description, when creating a new notepad...

CVE-2005-4189

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Calendar name field when creating calendars, 2 event title field when deleting events, the 3 Category and 4 Location search fields...

CVE-2005-4192

Multiple cross-site scripting XSS vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 the notepad's name or 2 description, when creating a new notepad...