CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 1CVE-2005-4192
https://notcve.org/view.php?id=CVE-2005-4192
Multiple cross-site scripting (XSS) vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) the notepad's name or (2) description, when creating a new notepad. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en templates/notepads/notepads.inc en Horde Mnemo Note Manager H3 anteriores a 2.0.3 permite a a usuarios remotos autenticados inyectar 'script' web o HTML arbitrario mediante (1) el nombre del bloc de notas o la (2) descripción, cuando se crea un bloc de notas. • http://cvs.horde.org/diff.php/mnemo/templates/notepads/notepads.inc?r1=1.9&r2=1.10&ty=h http://lists.horde.org/archives/announce/2005/000237.html http://secunia.com/advisories/17964 http://www.sec-consult.com/245.html http://www.securityfocus.com/bid/15803 http://www.vupen.com/english/advisories/2005/2833 •
CVSS: 4.3EPSS: 1%CPEs: 25EXPL: 2CVE-2005-4080 – Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection
https://notcve.org/view.php?id=CVE-2005-4080
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters. • https://www.exploit-db.com/exploits/26741 http://secunia.com/advisories/17910 http://securityreason.com/securityalert/232 http://securitytracker.com/id?1015315 http://www.securityfocus.com/archive/1/418734/100/0/threaded http://www.securityfocus.com/bid/15730 http://www.vupen.com/english/advisories/2005/2773 https://exchange.xforce.ibmcloud.com/vulnerabilities/23465 •
CVSS: 5.8EPSS: 0%CPEs: 31EXPL: 0CVE-2005-3759
https://notcve.org/view.php?id=CVE-2005-3759
Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) gzip/tar and (2) css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments. • http://lists.horde.org/archives/announce/2005/000232.html http://secunia.com/advisories/17599 http://secunia.com/advisories/17703 http://www.debian.org/security/2005/dsa-909 http://www.gentoo.org/security/en/glsa/glsa-200511-20.xml http://www.securityfocus.com/archive/1/417436/30/0/threaded http://www.securityfocus.com/bid/15535 http://www.vupen.com/english/advisories/2005/2536 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2005-3570
https://notcve.org/view.php?id=CVE-2005-3570
Unspecified cross-site scripting (XSS) vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages". • http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.207.2.109&r2=1.207.2.111&ty=h http://lists.horde.org/archives/announce/2005/000231.html http://secunia.com/advisories/17468 http://secunia.com/advisories/17702 http://secunia.com/advisories/17794 http://www.debian.org/security/2005/dsa-914 http://www.gentoo.org/security/en/glsa/glsa-200511-20.xml http://www.securityfocus.com/bid/15409 http://www.vupen.com/english/advisories/2005/2403 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2005-3344
https://notcve.org/view.php?id=CVE-2005-3344
The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access. La instalación por defecto de Horde 3.0.4 contiene una cuenta administrativa con una contraseña en blanco, lo que permite a atacantes remotos ganar acceso. • http://www.debian.org/security/2005/dsa-884 http://www.networkscanning.com/Horde-Default-Admin-Password-Vulnerability-VSS_20171.html http://www.osvdb.org/24117 http://www.securityfocus.com/bid/15337 https://exchange.xforce.ibmcloud.com/vulnerabilities/24576 •