CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16908
https://notcve.org/view.php?id=CVE-2017-16908
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed. En Horde Groupware 5.2.19, existe XSS mediante el campo Name durante la creación de un nuevo recurso. Esto puede aprovecharse para ejecutar código de forma remota tras comprometer una cuenta de administrador, ya que se puede omitir el mecanismo de protección CSRF relacionado con CVE-2015-7984. • http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html https://github.com/horde/kronolith/commit/39f740068ad21618f6f70b6e37855c61cadbd716 https://lists.debian.org/debian-lts-announce/2020/08/msg00048.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2017-16906
https://notcve.org/view.php?id=CVE-2017-16906
In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action. En Horde Groupware 5.2.19-5.2.22, existe XSS mediante el campo URL en una acción "Calendar -> New Event". • http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html https://github.com/horde/kronolith/commit/09d90141292f9ec516a7a2007bf828ce2bbdf60d https://github.com/starnightcyber/Miscellaneous/blob/master/Horde/README.md https://lists.debian.org/debian-lts-announce/2020/08/msg00049.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 2CVE-2017-15235 – Horde Groupware 5.2.21 - Unauthorized File Download
https://notcve.org/view.php?id=CVE-2017-15235
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename. El módulo File Manager (gollem) 3.0.11 en Horde Groupware 5.2.21 permite que atacantes remotos omitan la autenticación de Horde para descargas de archivos mediante un parámetro fn manipulado que corresponde al nombre de archivo exacto. • https://www.exploit-db.com/exploits/44059 https://blogs.securiteam.com/index.php/archives/3454 https://lists.debian.org/debian-lts-announce/2020/08/msg00050.html • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 8.1EPSS: 1%CPEs: 26EXPL: 1CVE-2017-14650
https://notcve.org/view.php?id=CVE-2017-14650
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line. • http://www.openwall.com/lists/oss-security/2017/09/21/4 https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b https://marc.info/?l=horde-announce&m=150600299528079&w=2 https://www.debian.org/security/2018/dsa-4276 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 24EXPL: 0CVE-2017-9774
https://notcve.org/view.php?id=CVE-2017-9774
Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication. Se ha encontrado una ejecución remota de código en Horde_Image en versiones 2.x anteriores a la 2.5.0 mediante una petición GET manipulada. Su explotación requiere autenticación. • https://lists.horde.org/archives/announce/2017/001234.html https://www.debian.org/security/2018/dsa-4276 • CWE-94: Improper Control of Generation of Code ('Code Injection') •