CVE-2007-1515

CVE-2007-1515 relates to multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3 (and possibly earlier). The NVD description indicates that remote attackers could inject arbitrary scripts via (1) the email Subject header in thread.php and (2) the edit_query parameter in search.p...

CVE-2007-1515

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1473

Cross-site scripting XSS vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the newlang parameter to login.php...

CVE-2007-1474

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

Design/Logic Flaw

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

CVE-2007-1474

Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames...

CVE-2007-1474

CVE-2007-1474 affects Horde Project Horde and IMP prior to Horde Application Framework 3.1.4. The vulnerability is an argument injection flaw in the cleanup cron script that can let local users delete arbitrary files and potentially gain privileges by supplying multiple space-delimited pathnames....

CVE-2007-1473

CVE-2007-1473 is a cross-site scripting (XSS) vulnerability in Horde Framework’s login page (framework/NLS/NLS.php) via the new_lang parameter in login.php, affecting Horde Framework before 3.1.4 RC1. Multiple connected advisories confirm the issue and reference fixed versions/updates for Horde3 ...

Horde NLS.php Language Selection new_lang Parameter XSS

The version of Horde installed on the remote host fails to sanitize input to the 'newlang' parameter before using it in the 'framework/NLS/NLS.php' script to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code in...

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/22975/info Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails...

Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22984/info Horde Framework is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially...

Horde Framework and IMP 2.x3.x - Cleanup Cron Script Arbitrary File Deletion

Horde Framework and IMP 2.x3.x - Cleanup Cron Script Arbitrary File Deletion source: https://www.securityfocus.com/bid/22985/info Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application. A...

Horde Framework 3.1.3 - login.php Cross-Site Scripting

Horde Framework 3.1.3 - login.php Cross-Site Scripting source: https://www.securityfocus.com/bid/22984/info Horde Framework is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute...

Horde < 3.1.4 NLS.php new_lang Parameter XSS

Binary data 3950.prm...

[Full-disclosure] Horde 3.1.4 &#40;RC1&#41; fixes XSS issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, a few hours ago, Horde Framework 3.1.4 was released. This stable release as well as a previous development release titled 3.1.4 RC1 fix a script/HTML injection issue which does not require pevious authentication by the victim. By redirecting the...

Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion

source: https://www.securityfocus.com/bid/22985/info Horde Framework and IMP are prone to a vulnerability that allows a local attacker to delete arbitrary files in the context of the user running the application. A successful attack can reduce the integrity of affected computers and may aid in...

Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/22975/info Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and scrip...

[Full-disclosure] Horde IMP Webmail Client version H3 &#40;4.1.4&#41; fixes multiple XSS issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Horde IMP Webmail Client version H3 4.1.4 was released a few hours ago. It contains fixes for 2 XSS issues compared to 4.1.4 RC1. 1. Script injection through email subject lines in threaded view Subject lines of emails, when displayed in vulnerabl...

Horde Groupware Calendar组件本地文件包含漏洞

Horde Groupware Calendar是一款基于PHP的WEB应用程序。 Horde Groupware Calendar不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行查看系统文件内容。 Horde Groupware Webmail Edition 1.0-RC2 Horde Groupware 1.0-RC3 厂商解决方案 升级程序： Horde Groupware 1.0-RC3 Horde horde-groupware-1.0.tar.gz...

CVE-2007-0579

Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors. NOTE: some of these details are obtained from third party information...