CVE-2008-7218

The CVE-2008-7218 entry concerns an unspecified vulnerability in the Horde API affecting Horde 3.x (including Horde, Turba H3, Kronolith H3, Nag H3, Mnemo H3) and Horde Groupware/Groupware Webmail Edition with multiple pre-release version gaps. Public sources concur the vulnerability has unknown ...

CVE-2008-0807

CVE-2008-0807 affects Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, deployed in Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5. The flaw in lib/Driver/sql.php fails to properly check access rights, allowing remote authenticated use...

CVE-2007-6018

CVE-2007-6018 affects IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3, where insufficient validation of HTTP requests allows a remote attacker to (1) delete arbitrary emails via a modified numeric ID and (2) purge deleted emails via a crafted...

CVE-2008-1284

CVE-2008-1284 affects Horde 3.1.6, Groupware up to 1.0.5, and Groupware Webmail Edition up to 1.0.6. The vulnerability is a directory traversal via ../ and a null byte in the theme name, allowing remote authenticated users to read and execute arbitrary files. The NVD entry lists a CVSSv2 base sco...

CVE-2008-7219

CVE-2008-7219 affects Horde Kronolith H3 (2.1 up to before 2.1.7; 2.2 before 2.2-RC2), Nag H3 (2.1 before 2.1.4; 2.2 before 2.2-RC2), Mnemo H3 (2.1 before 2.1.2; 2.2 before 2.2-RC2), Groupware (1.0 before 1.0.3; 1.1 before 1.1-RC2) and Groupware Webmail Edition (1.0 before 1.0.4; 1.1 before 1.1-R...

CVE-2012-0791

CVE-2012-0791 is a set of cross-site scripting (XSS) vulnerabilities in Horde IMP and Horde Groupware Webmail Edition. The NVD description specifies XSS vectors via composeCache, rtemode, filename_* on the compose page; the contacts popup formname; and IMAP mailbox names. Affected products/versio...

CVE-2008-1974

CVE-2008-1974 is an XSS vulnerability in Horde Kronolith (Kronolith 2.1.x and Groupware variants) where the url parameter in addevent.php can inject arbitrary script/HTML. The issue is reported as insufficient input sanitisation in Kronolith’s add-event flow, allowing remote attackers to execute ...

CVE-2012-0909

CVE-2012-0909 is an XSS in Horde_Form within Horde Groupware Webmail Edition prior to 4.0.6. Public records show fixes in Horde3 branch to 3.3.13 (openSUSE openSUSE-SU-2012:0286-1) and related security updates; remediation involves upgrading to Horde Groupware Webmail Edition 4.0.6 or newer, or H...

CVE-2008-2783

CVE-2008-2783 describes multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, including Groupware Webmail Edition and Kronolith. The flaws allow remote attackers to inject arbitrary script or HTML via the timestamp parameter to week.php, workweek.php, and day.php, and via the ho...

CVE-2008-3650

CVE-2008-3650 affects Horde Groupware Webmail prior to Edition 1.1.1 (final). The reported issue involves unescaped output that could enable cross-site scripting (XSS) in the object browser and the contact view. Documentation across multiple sources reiterates unknown impact vectors and lacks exp...