CVSS: 4.3EPSS: 1%CPEs: 37EXPL: 1CVE-2007-1473 – Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1473
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en framework/NLS/NLS.php en Horde Framework anterior a 3.1.4 RC1, cuando la página de login contiene una caja de elección de idioma, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro new_lang en login.php. • https://www.exploit-db.com/exploits/29745 http://lists.horde.org/archives/announce/2007/000315.html http://secunia.com/advisories/24528 http://secunia.com/advisories/24995 http://secunia.com/advisories/27565 http://securityreason.com/securityalert/2427 http://securitytracker.com/id?1017775 http://www.debian.org/security/2007/dsa-1406 http://www.novell.com/linux/security/advisories/2007_007_suse.html http://www.osvdb.org/33084 http://www.securityfocus.com/archive/1/462915/ •
CVSS: 6.8EPSS: 1%CPEs: 24EXPL: 1CVE-2007-1474 – Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2007-1474
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames. Vulnerabilidad de inyección de argumento en la secuencia de comandos cleanup para cron de Horde Project Horde e IMP anterior a Horde Application Framework 3.1.4 permite a usuarios locales borrar archivos de su elección y posiblemente obtener privilegios mediante múltiples nombres de ruta separados por espacios. • https://www.exploit-db.com/exploits/29746 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489 http://lists.horde.org/archives/announce/2007/000315.html http://secunia.com/advisories/27565 http://www.debian.org/security/2007/dsa-1406 http://www.securityfocus.com/bid/22985 http://www.securitytracker.com/id?1017784 http://www.securitytracker.com/id?1017785 http://www.vupen.com/english/advisories/2007/0965 https://exchange.xforce.ibmcloud.com/vulnerabilities/32997 •