CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

Design/Logic Flaw

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-30287

CVE-2022-30287 affects Horde Groupware Webmail Edition up to 5.2.22, enabling a reflection injection that allows arbitrary deserialization of PHP objects via a driver-class instantiation. Debian advisories note fixes in php-horde-turba: 4.2.25-5+deb11u2 for Debian 11 (and related LTS advisories f...

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

RainLoop Webmail 跨站脚本漏洞

RainLoop Webmail is a web-based email client software. A cross-site scripting vulnerability exists in RainLoop Webmail 1.6.0 and earlier versions, which stems from a failure to properly clean up when processing HTML content, and can be exploited by an attacker to take control of a victim's sessio...

CVE-2022-30287: Use of Externally-Controlled Input to Select Classes or Code

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

Cross site scripting

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

CVE-2022-31470: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

PT-2022-20748 · Axigen · Axigen Mobile Webmail

Name of the Vulnerable Software and Affected Versions: Axigen Mobile WebMail versions prior to 10.2.3.12 Axigen Mobile WebMail versions 10.3.x prior to 10.3.3.47 Description: The issue allows attackers to run arbitrary Javascript code, using an active end-user session for a logged-in user, to...

Axigen Mobile WebMail 跨站脚本漏洞

Axigen Mobile WebMail is a mobile webmail service from Axigen Romania. A security vulnerability exists in Axigen Mobile WebMail versions prior to 10.2.3.12 and prior to 10.3.3.47, which stems from a cross-site scripting issue in the reset password section of indexmobilechangepass.hsp...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

CVE-2022-31470

Summary of CVE-2022-31470 : The issue is an XSS vulnerability in Axigen Mobile WebMail (and Axigen WebMail entries in related docs) that allows an attacker with an active user session to execute arbitrary JavaScript and access mailbox content. Concrete details across connected sources indicate tw...

Horde Groupware Webmail 跨站请求伪造漏洞

Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. PHP is a scripting language that executes on the server side. A cross-site request forgery vulnerability exists in Horde Groupware Webmail that stems from insufficient authentication of the source o...