CVE-2005-4080

Horde IMP 4.0.4 and earlier are vulnerable to cross-site scripting (XSS) due to failure to sanitize strings containing UTF-16 null characters. The issue allows remote attackers to craft UTF-16 encoded attachments/strings that execute when viewed in Internet Explorer (which ignores the null chars)...

CVE-2005-4080

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting XSS attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters...

GLSA-200511-20 : Horde Application Framework: XSS vulnerability

The remote host is affected by the vulnerability described in GLSA-200511-20 Horde Application Framework: XSS vulnerability The Horde Team reported a potential XSS vulnerability. Horde fails to properly escape error messages which may lead to displaying unsanitized error messages via...

Horde IMP Webmail Client XSS all versions

Hello All, PRELUDE What is HORDE? http://www.horde.org/about/ The Mission The Horde Project is about creating high quality Open Source applications, based on PHP and the Horde Framework. The guiding principles of the Horde Project are to create solid standards-based applications using intelligent...

Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection

source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be...

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...

Horde MIME Viewer vulnerability

Title : Cross-Site-Scripting Vulnerability in Horde IMP. Date : November 17, 2005 Product : Horde MIME Viewer 3.0.7 vulnerability Discovered by : Daniel Schreckling Overview ====================================================================== The Horde http://www.horde.org Project comprises a s...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3759

CVE-2005-3759: Horde webmail suite prior to 3.0.7 contains cross-site scripting vulnerabilities in the MIME viewers (gzip/tar and css) that do not filter/escape HTML when displaying attachments. Affected products include Horde up to 3.0.7; Debian/SUSE advisories reference Horde3 with fixes in 3.0...

CVE-2005-3759

Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...

CVE-2005-3570

Unspecified cross-site scripting XSS vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages"...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access...

CVE-2005-3344

The CVE-2005-3344 issue affects Horde Groupware/Horde3 where the default installation ships with an administrative account that has a blank password. This enables unauthenticated remote access to administrative functions, potentially compromising the system. Debian’s DSA-884-1 advisory fixes Hord...

CVE-2005-3570

CVE-2005-3570 affects Horde webmail/application framework versions prior to 2.2.9. The vulnerability arises from unescaped error messages, enabling a remote attacker to inject arbitrary scripts or HTML (XSS) via not properly escaped error messages. Technical references in connected documents conf...

Horde Admin Account Default Password

The remote installation of horde uses an administrative account with no password. An attacker can leverage this issue to gain full control over the affected application and to run arbitrary shell, PHP, and SQL commands using the supplied admin utilities. Note that while the advisory is from Debia...

Horde and IMP test disclosure

The remote server is running Horde and/or IMP with test scripts available from the outside. The scripts may leak server-side information that is valuable to an attacker. OpenVAS Vulnerability Test $Id: hordetestdisclosure.nasl 6056 2017-05-02 09:02:50Z teissa $ Description: Horde and IMP test...

Horde < 3.2.2 IMP_MIME_Viewer_html class XSS Vulnerabilities

The remote server is running at least one instance of Horde IMP whose version number is between 3.0 and 3.2.1 inclusive. SPDX-FileCopyrightText: 2003-2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...