CVSS: 4.3EPSS: 1%CPEs: 13EXPL: 0CVE-2006-4256
https://notcve.org/view.php?id=CVE-2006-4256
index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different than classic XSS. index.php en Horde Application Framework anerior a 3.1.2 permite a atacantes remotos incluir páginas web de otros sitios, lo que podría ser útil para ataques de phishing, mediante una URL en el parámetro url, también conocido como "referencia en sitios cruzados" (cross-site referencing). NOTA: algunas fuetnes se han referido a este problema como XSS, pero es diferente del clásico XSS. • http://lists.horde.org/archives/announce/2006/000292.html http://secunia.com/advisories/21500 http://secunia.com/advisories/27565 http://securityreason.com/securityalert/1422 http://securitytracker.com/id?1016713 http://www.debian.org/security/2007/dsa-1406 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2456 http://www.securityfocus.com/archive/1/443360/100/0/threaded http://www.vupen.com/english/advisories/2006/3309 https://exchange.xforce.ibmcloud.com/vulnerabilities/28411 •
CVSS: 7.5EPSS: 35%CPEs: 12EXPL: 1CVE-2006-1491 – Horde 3.0.9/3.1.0 - Help Viewer Remote Code Execution
https://notcve.org/view.php?id=CVE-2006-1491
Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer. • https://www.exploit-db.com/exploits/1660 http://cvs.horde.org/diff.php?f=horde%2Fservices%2Fhelp%2Findex.php&r1=2.85&r2=2.86 http://lists.horde.org/archives/announce/2006/000271.html http://lists.horde.org/archives/announce/2006/000272.html http://secunia.com/advisories/19485 http://secunia.com/advisories/19504 http://secunia.com/advisories/19528 http://secunia.com/advisories/19619 http://secunia.com/advisories/19692 http://securitytracker.com/id?1015841 http://www • CWE-94: Improper Control of Generation of Code ('Code Injection') •