CVE-2008-5917

Cross-site scripting XSS vulnerability in the XSS filter framework/TextFilter/Filter/xss.php in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes...

CVE-2008-5917

The CVE-2008-5917 entry describes a Cross-site scripting (XSS) vulnerability in Horde Application Framework’s Text_Filter/Filter/xss.php, affecting Horde 3.2.2 and 3.3. It is reported when using Internet Explorer, allowing remote attackers to inject arbitrary web script or HTML via unknown vector...

Fedora 9 : horde-3.2.1-1.fc9 (2008-5683)

Update to the New Horde Application Framework 3.2.1 Includes security fixes XSS in object browser Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

GLSA-200805-01 : Horde Application Framework: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200805-01 Horde Application Framework: Multiple vulnerabilities Multiple vulnerabilities have been reported in the Horde Application Framework: David Collins, Patrick Pelanne and the HostGator.com LLC support team discovered that...

CVE-2007-6018

CVE-2007-6018 affects IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3, where insufficient validation of HTTP requests allows a remote attacker to (1) delete arbitrary emails via a modified numeric ID and (2) purge deleted emails via a crafted...

openSUSE 10 Security Update : horde (horde-1868)

This update fixes the following two security issues in the Horde Application Framework : - CVE-2006-3548: Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a 1 JavaScript URI or an external 2 http, 3 https, or 4 ftp URI in the url...

CVE-2004-2741

Cross-site scripting XSS vulnerability in the "help window" help.php in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the 1 module, 2 topic, or 3 module parameters...

CVE-2004-2741

The CVE covers a Cross-site scripting (XSS) vulnerability in Horde Application Framework 2.2.6, specifically in the Help Window (help.php) of the Horde Help subsystem. The issue arises from improper sanitization of three parameters (module, topic, and module) that can be exploited remotely to inj...

CVE-2006-4256

index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different...

CVE-2006-4256

index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different...

CVE-2006-4256

index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different...

CVE-2006-4256

The CVE-2006-4256 issue affects the Horde Application Framework prior to 3.1.2, where index.php can include web pages from other sites via the url parameter, enabling cross-site referencing that could aid phishing. Affected platforms and advisories corroborate remote inclusion risks, with related...

CVE-2006-3549

services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via 1 http, 2 https, and 3 ftp URL in the url parameter...

CVE-2006-3548

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a 1 javascript URI or an external 2 http, 3 https, or 4 ftp URI in the url parameter in services/go.php a...

CVE-2006-3549

services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via 1 http, 2 https, and 3 ftp URL in the url parameter...

CVE-2006-3549

The CVE-2006-3549 vulnerability affects Horde Application Framework (Horde3) where services/go.php does not properly restrict its image proxy capability, enabling remote attackers to perform Web tunneling and use the server as a proxy via http, https, or ftp URLs in the url parameter. Technical d...

CVE-2006-3548

CVE-2006-3548 is a set of XSS flaws in Horde Application Framework (versions 3.0.0–3.0.10 and 3.1.0–3.1.1) exploitable via (1) url in go.php, (2) http/https/ftp URI in various parameters, (3) javascript URI in module, (4) name in problem.php. Root cause is inadequate input sanitization that allow...

CVE-2006-3548

Multiple cross-site scripting XSS vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a 1 javascript URI or an external 2 http, 3 https, or 4 ftp URI in the url parameter in services/go.php a...

CVE-2006-3549

services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via 1 http, 2 https, and 3 ftp URL in the url parameter...

horde3113010.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0011 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ Horde 3.1.1, 3.0.10 Multiple Security Issues +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON July 05, 2006 PUBLISHED AT...