CVSS: 8.8EPSS: 94%CPEs: 4EXPL: 2CVE-2019-9858 – Horde Form Shell Upload
https://notcve.org/view.php?id=CVE-2019-9858
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) .. • http://packetstormsecurity.com/files/152476/Horde-Form-Shell-Upload.html https://lists.debian.org/debian-lts-announce/2019/06/msg00007.html https://seclists.org/bugtraq/2019/Jun/31 https://ssd-disclosure.com/?p=3814&preview=true https://www.debian.org/security/2019/dsa-4468 https://www.ratiosec.com/2019/horde-groupware-webmail-authenticated-arbitrary-file-injection-to-rce • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.9EPSS: 0%CPEs: 12EXPL: 1CVE-2017-17688
https://notcve.org/view.php?id=CVE-2017-17688
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification ** EN DISPUTA ** La especificación OpenPGP permite un ataque malleability-gadget Cipher Feedback Mode (CFB) que puede conducir indirectamente a la exfiltración en texto plano. Esto también se conoce como EFAIL. NOTA: terceros indican que este es un problema en aplicaciones que gestionan de manera incorrecta la característica de Modification Detection Code (MDC) o que afectan un tipo de paquete obsoleto, en lugar de un problema en la especificación OpenPGP. • http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html http://www.securityfocus.com/bid/104162 http://www.securitytracker.com/id/1040904 https://efail.de https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html https://news.ycombinator.com/item?id=17066419 https://protonmail.com/blog/pgp-vulnerability-efail https://twitter.com/matthew_d_green/status/995996706457243648 https://www.patreon.com/posts/cybersecurity-15-18814817 https://www.synology.com/support/security&#x •
CVSS: 5.9EPSS: 0%CPEs: 21EXPL: 1CVE-2017-17689
https://notcve.org/view.php?id=CVE-2017-17689
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. La especificación S/MIME permite un ataque malleability-gadget Cipher Block Chaining (CBC) que puede conducir indirectamente a la exfiltración en texto plano. Esto también se conoce como EFAIL. • http://www.securityfocus.com/bid/104165 https://efail.de https://news.ycombinator.com/item?id=17066419 https://pastebin.com/gNCc8aYm https://twitter.com/matthew_d_green/status/996371541591019520 https://www.synology.com/support/security/Synology_SA_18_22 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3999
https://notcve.org/view.php?id=CVE-2014-3999
The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. La biblioteca Horde_Ldap en versiones anteriores a la 2.0.6 para Horde permite que atacantes remotos omitan la autenticación aprovechando el conocimiento del DN del usuario bind LDAP. • http://www.openwall.com/lists/oss-security/2014/06/14/1 http://www.securityfocus.com/bid/68014 https://bugzilla.redhat.com/show_bug.cgi?id=1109628 https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55 https://marc.info/?l=horde-announce&m=140178644816474&w=2 • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2017-16907
https://notcve.org/view.php?id=CVE-2017-16907
In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action. En Horde Groupware 5.2.19 y 5.2.21, existe XSS mediante el campo Color en una acción Create Task List. • http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html https://github.com/horde/base/commit/fb2113bbcd04bd4a28c46aad0889fb0a3979a230 https://lists.debian.org/debian-lts-announce/2020/08/msg00046.html https://lists.debian.org/debian-lts-announce/2020/08/msg00047.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •