PT-2011-1726

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 4.3.8 Horde Groupware Webmail Edition versions prior to 1.2.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the username aka fmusername, password aka fmpassword, or server...

PT-2011-1431

Name of the Vulnerable Software and Affected Versions Horde Dynamic IMP DIMP versions prior to 1.1.5 Horde Groupware Webmail Edition versions prior to 1.2.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML, specifically when displaying...

CVE-2010-3693: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Horde Dynamic IMP DIMP before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names...

CVE-2010-4778: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the 1 username aka fmusername, 2 password aka fmpassword, or 3 server aka fmserver...

CVE-2010-3695

Cross-site scripting XSS vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fmid parameter in a fetchmailprefssave action, related to the Fetchmail configuration...

CVE-2010-3695

Cross-site scripting XSS vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fmid parameter in a fetchmailprefssave action, related to the Fetchmail configuration...

CVE-2010-3695

CVE-2010-3695 is a cross-site scripting (XSS) vulnerability in Horde IMP (before 4.3.8) and Horde Groupware Webmail Edition (before 1.2.7). The flaw allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in the fetchmail_prefs_save action (Fetchmail configuration)....

PT-2011-1432

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 4.3.8 Horde Groupware Webmail Edition versions prior to 1.2.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the fm id parameter in a "fetchmail prefs save" action, related ...

CVE-2010-3695: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fmid parameter in a fetchmailprefssave action, related to the Fetchmail configuration...

[SECURITY] Fedora 15 Update: roundcubemail-0.5.1-1.fc15

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] [DSA 2204-1] imp4 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2204-1 [email protected] http://www.debian.org/security/ Steffen Joeris March 27, 2011 http://www.debian.org/security/faq -...

Debian DSA-2204-1 : imp4 - insufficient input sanitising

Moritz Naumann discovered that IMP 4, a webmail component for the Horde framework, is prone to cross-site scripting attacks by a lack of input sanitising of certain Fetchmail information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] [DSA 2204-1] imp4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2204-1 [email protected] http://www.debian.org/security/ Steffen Joeris March 27, 2011 http://www.debian.org/security/faq -...

DSA-2204-1 imp4 - Insufficient input sanitising

Bulletin has no description...

CVE-2010-4464

Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail...

Design/Logic Flaw

Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail...

CVE-2010-4464

Concrete remediation details exist in connected docs: Solaris patch 137631-17 (SPARC) and 137632-17 (x86) address Sun Convergence 1.0-17.01 core patch and are listed alongside CVE-2010-4464 (and related CVEs) in Nessus plugins. The affected product is Sun Convergence 1.0; remediation is to instal...

CVE-2010-4464

Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail...

CVE-2010-4464: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail...

PT-2011-1568

Name of the Vulnerable Software and Affected Versions Oracle Sun Convergence version 1.0 Description The issue affects confidentiality and integrity, allowing remote attackers to exploit it via unknown vectors related to Webmail. Recommendations For Oracle Sun Convergence version 1.0, at the...