CVSS: 5.0EPSS: 0%CPEs: 41EXPL: 0CVE-2010-0463
https://notcve.org/view.php?id=CVE-2010-0463
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests. Horde IMP v4.3.6 y anteriores no solicitan que el navegador web permita el "prefetching" DNS de los nombres de dominio contenidos en mensajes de correo electrónico, lo que facilita a atacantes remotos determinar la localización de red del usuario de webmail mediante peticiones de logggin DNS. • http://bugs.horde.org/ticket/8836 https://exchange.xforce.ibmcloud.com/vulnerabilities/56052 https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 2CVE-2007-1515 – Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-1515
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Horde IMP H3 4.1.3 y, posiblemente, versiones anteriores, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante (1) la cabecera del Subject de los email en el thread.php,(2) el parámetro edit_query del search.php u otros parámetros sin especificar en el search.php. NOTA: algunos de los detalles se obtienen a partir de la información de terceros. • https://www.exploit-db.com/exploits/29742 http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html http://lists.horde.org/archives/announce/2007/000316.html http://secunia.com/advisories/24541 http://www.securityfocus.com/archive/1/462914/100/0/threaded http://www.securityfocus.com/bid/22975 http://www.securitytracker.com/id?1017774 http://www.vupen.com/english/advisories/2007/0964 •