2039 matches found
CVE-2002-0181
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...
CVE-2002-0181
CVE-2002-0181 — Horde IMP status.php3 XSS is confirmed in connected OpenVAS/NVD entries. The vulnerability arises in the status.php3 parameter handling of IMP 2.2.8 and HORDE 1.2.7, where user-supplied data is not properly sanitized, enabling cross-site scripting and potential cookie theft when a...
CVE-2002-0181: Undefined Security Weakness
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...
CVE-2001-1370: Undefined Security Weakness
prepend.php3 in PHPLib before 7.2d, when registerglobals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $PHPLIBlibdir to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages...
Horde IMP mailbox.php3 Multiple Parameter SQL Injection
The remote server is running IMP, a web-based mail client. There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script. An attacker may use this flaw to gain unauthorized access to a user mailbox or...
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...
PT-2002-2745 · Horde · Horde Imp
Name of the Vulnerable Software and Affected Versions: Horde IMP version 2.2.7 Description: The issue allows remote attackers to obtain the full web root pathname via specific HTTP requests. This can be achieved by requesting certain files, including poppassd.php3, login.php3?reason=chpass2,...
CVE-2001-1257
Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...
CVE-2001-1258
Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...
CVE-2001-1258
CVE-2001-1258 affects the Horde IMP before 2.2.6. According to the Debian DSA-073-1 advisory and related sources, a hostile user who can place a publicly readable prefs.lang file on the Apache/PHP server can have that file executed as PHP code, enabling access to config data and potentially the H...
CVE-2001-1257: Undefined Security Weakness
Cross-site scripting vulnerability in Horde Internet Messaging Program IMP before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email...
CVE-2001-1258: Undefined Security Weakness
Horde Internet Messaging Program IMP before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server...
CVE-2002-0181
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...
[SECURITY] [DSA-126-1] Horde and IMP cross-site scripting attack
Package : imp Problem type : cross-site scripting CSS Debian-specific: no A cross-site scripting CSS problem was discovered in Horde and IMP a web based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version...
Imp Webmail session hijacking vulnerability
It's possible to hijack an imp/horde session using a cross-site script attack, quite similar to the one explored by Marc Slemko in his "Microsoft Passport to Trouble" paper. - After hijacking the cookies, the attacker can use the session and read the victim's mail. - Imp...
Вставка скриптов в URL в Horde IMP (crossite scripting)
Вставив скрипт в URL можно получить доступ к сеансовым cookie...
Horde Imp Webmail status.php3 message Parameter XSS
The remote server is running IMP 2.2.7. Such versions are potentially affected by a cross-site scripting attack which can be used by an attacker to hijack a victim's IMP session. Nessus solely relied on the version number of your installation, so if you applied the hotfix already, consider this...
Horde IMP 2.2.x - Session Hijacking
Horde IMP 2.2.x - Session Hijacking source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to...
Horde IMP 2.2.x - Session Hijacking
source: https://www.securityfocus.com/bid/3525/info IMP is a powerful web-based mail interface/client developed by members of the Horde project. Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to construct a link which when clicked wi...