Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
HordeGroupware*

23 matches found

CVE
CVE•added 2021/02/14 4:15 a.m.•143 views

CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke ...

6.1CVSS5.8AI score0.02965EPSS
Web
CVE
CVE•added 2019/10/24 6:15 p.m.•120 views

CVE-2019-12095

Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.

8.8CVSS8.1AI score0.00478EPSS
Web
CVE
CVE•added 2019/10/24 5:15 p.m.•118 views

CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.

6.1CVSS6.8AI score0.00953EPSS
Web
CVE
CVE•added 2022/07/28 10:15 p.m.•92 views

CVE-2022-30287

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.

8CVSS7.8AI score0.08128EPSS
CVE
CVE•added 2020/05/18 3:15 p.m.•78 views

CVE-2020-8035

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

6.1CVSS5.8AI score0.0045EPSS
CVE
CVE•added 2009/12/21 4:30 p.m.•65 views

CVE-2009-3701

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phps...

4.3CVSS5.5AI score0.02191EPSS
CVE
CVE•added 2015/11/19 8:59 p.m.•64 views

CVE-2015-7984

Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd param...

6.8CVSS6.6AI score0.01484EPSS
Web
CVE
CVE•added 2016/04/13 4:59 p.m.•64 views

CVE-2016-2228

Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplor...

6.1CVSS5.9AI score0.00575EPSS
Web
CVE
CVE•added 2017/04/04 2:59 p.m.•61 views

CVE-2017-7413

In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email add...

9CVSS8.5AI score0.18475EPSS
CVE
CVE•added 2008/03/11 12:44 a.m.•54 views

CVE-2008-1284

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

6CVSS6.5AI score0.01313EPSS
CVE
CVE•added 2011/03/31 10:55 p.m.•52 views

CVE-2010-3695

Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration...

4.3CVSS5.5AI score0.01256EPSS
CVE
CVE•added 2019/11/05 7:15 p.m.•51 views

CVE-2013-6275

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

6.5CVSS6.4AI score0.01945EPSS
CVE
CVE•added 2017/11/20 8:29 p.m.•50 views

CVE-2017-16906

In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.

5.4CVSS5AI score0.00249EPSS
CVE
CVE•added 2009/12/21 4:30 p.m.•47 views

CVE-2009-4363

Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html v...

4.3CVSS5AI score0.00477EPSS
CVE
CVE•added 2014/04/05 9:55 p.m.•42 views

CVE-2012-5565

Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic ...

4.3CVSS5.6AI score0.00295EPSS
Web
CVE
CVE•added 2014/04/05 9:55 p.m.•42 views

CVE-2012-6640

Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.

4.3CVSS5.6AI score0.00296EPSS
CVE
CVE•added 2014/07/14 2:55 p.m.•40 views

CVE-2014-4945

Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.

4.3CVSS5.9AI score0.00516EPSS
CVE
CVE•added 2008/06/19 8:41 p.m.•36 views

CVE-2008-2783

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to (1) week.php, (2) workweek.php, and (3) day.php; and (4) the horde parameter in the PATH_INFO...

4.3CVSS5.7AI score0.00274EPSS
CVE
CVE•added 2014/04/05 9:55 p.m.•36 views

CVE-2012-5566

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view.

4.3CVSS5.8AI score0.00648EPSS
CVE
CVE•added 2014/07/14 2:55 p.m.•34 views

CVE-2014-4946

Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.

4.3CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2011/04/04 12:27 p.m.•33 views

CVE-2010-3693

Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.

4.3CVSS5.8AI score0.00684EPSS
CVE
CVE•added 2011/04/04 12:27 p.m.•33 views

CVE-2010-4778

Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (a...

4.3CVSS5.8AI score0.01256EPSS
CVE
CVE•added 2014/04/05 9:55 p.m.•30 views

CVE-2012-5567

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist,...

4.3CVSS5.8AI score0.00618EPSS