CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0CVE-2014-4946
https://notcve.org/view.php?id=CVE-2014-4946
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view. Múltiples vulnerabilidades de XSS en Horde Internet Mail Program (IMP) anterior a 6.1.8, utilizado en Horde Groupware Webmail Edition anterior a 5.1.5, permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) indicadores no especificados o (2) un nombre de buzón en la visualización dinámica de buzones. • http://lists.horde.org/archives/announce/2014/001019.html http://lists.horde.org/archives/announce/2014/001025.html http://secunia.com/advisories/59770 http://secunia.com/advisories/59772 https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 31EXPL: 0CVE-2012-5565
https://notcve.org/view.php?id=CVE-2012-5565
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view. Vulnerabilidad de XSS en js/compose-dimp.js en Horde Internet Mail Program (IMP) anterior a 5.0.24, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un nombre manipulado para un archivo adjunto, relacionado con la visualización dinámica. • http://lists.horde.org/archives/announce/2012/000833.html http://lists.horde.org/archives/announce/2012/000840.html http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html http://www.openwall.com/lists/oss-security/2012/11/23/6 https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0CVE-2012-6640
https://notcve.org/view.php?id=CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565. Vulnerabilidad de XSS en Horde Internet Mail Program (IMP) anterior a 5.0.22, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un adjunto de imagen SVG manipulado, una vulnerabilidad diferente a CVE-2012-5565. • http://lists.horde.org/archives/announce/2012/000775.html http://lists.horde.org/archives/announce/2012/000840.html https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 3%CPEs: 4EXPL: 2CVE-2013-6275 – Horde Groupware Web Mail Edition 5.1.2 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2013-6275
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. Múltiples problemas de tipo CSRF en Horde Groupware Webmail Edition versión 5.1.2 y anteriores en el archivo basic.php. Horde Groupware Web Mail Edition version 5.1.2 suffers from multiple cross site request forgery vulnerabilities. • https://www.exploit-db.com/exploits/29274 http://archives.neohapsis.com/archives/bugtraq/2013-10/0134.html http://www.exploit-db.com/exploits/29274 http://www.securityfocus.com/bid/63377 http://www.securitytracker.com/id/1029285 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-6275 https://exchange.xforce.ibmcloud.com/vulnerabilities/88321 https://security-tracker.debian.org/tracker/CVE-2013-6275 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 128EXPL: 0CVE-2012-0791
https://notcve.org/view.php?id=CVE-2012-0791
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information. Múltiples vulnerbilidades de ejecución de secuencias de comandos web en sitios cruzados (XSS) en Horde IMP anterior a v5.0.18 y Horde Groupware Webmail Edition anterior a v4.0.6 permite a atacantes remotos inyectar código HTML o script web a través de los parámetros que componen la página (1) composeCache, (2) rtemode, o (3) filename_*;(4) parámetro formname para ventanas popup; o (5) nombres de buzón IMAP. NOTA: Algunos de estos detalles han sido obtenidos de terceras partes de información. • http://secunia.com/advisories/47580 http://secunia.com/advisories/47592 http://www.debian.org/security/2012/dsa-2485 http://www.horde.org/apps/imp/docs/CHANGES http://www.horde.org/apps/imp/docs/RELEASE_NOTES http://www.horde.org/apps/webmail/docs/CHANGES http://www.horde.org/apps/webmail/docs/RELEASE_NOTES http://www.openwall.com/lists/oss-security/2012/01/22/2 http://www.securityfocus.com/bid/51586 http://www.securitytracker.com/id?1026553 http://w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •