CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload...

Cross site request forgery (csrf)

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

DEBIAN-CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

UBUNTU-CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload...

CVE-2019-12095

CVE-2019-12095 affects Horde Trean (Horde Groupware Webmail Edition up to 5.2.22 and related products). The flaw enables CSRF via the treanBookmarkTags parameter to the trean/ URI on a webmail server, with the note that treanBookmarkTags could carry a stored XSS payload. Public documents confirm ...

CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-12094

CVE-2019-12094 affects Horde Groupware Webmail Edition through 5.2.22. The vulnerability allows XSS via crafted URIs such as admin/user.php?form=update_f&user_name=, admin/user.php?form=remove_f&user_name=, or admin/config/diff.php?app=, as documented in the CVE entry and OSV/NVD references. The ...

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

PT-2019-12636

Name of the Vulnerable Software and Affected Versions Horde Groupware Webmail Edition versions prior to 5.2.23 Description The issue allows for XSS attacks via specific URI parameters. This can be achieved through the admin/user.php endpoint with either the form=update f or form=remove f paramete...

CVE-2019-12095: Improper Neutralization of Input During Web Page Generation

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload...

CVE-2019-12094: Improper Neutralization of Input During Web Page Generation

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2010-5339: Improper Neutralization of Input During Web Page Generation

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter dlgcaptchauid is non-persistent in 10.1.3 and 10.2.0...

CVE-2010-5338: Improper Neutralization of Input During Web Page Generation

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter dlgcaptchaaction is non-persistent in 10.1.3 and 10.2.0...

PT-2019-6605

Name of the Vulnerable Software and Affected Versions IceWarp Webclient versions prior to 10.2.1 Description The issue is related to a non-persistent XSS vulnerability via an HTTP POST request to the "webmail/basic/" endpoint with the parameter dlgcaptchacontroller. This affects versions prior to...

PT-2019-6607

Name of the Vulnerable Software and Affected Versions IceWarp Webclient versions prior to 10.2.1 Description The issue is related to a non-persistent XSS vulnerability via an HTTP POST request to the "webmail/basic/" endpoint with the parameter dlgcaptchauid. This affects versions prior to 10.2.1...

PT-2019-6606

Name of the Vulnerable Software and Affected Versions IceWarp Webclient versions prior to 10.2.1 Description The issue is related to a non-persistent XSS vulnerability via an HTTP POST request to the "webmail/basic/" endpoint with the parameter dlgcaptchaaction. This vulnerability is present in...