Page 4 of 23 results (0.004 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages. • http://bugs.horde.org/show_bug.cgi?id=916 http://www.iss.net/security_center/static/8768.php http://www.securityfocus.com/bid/4445 • CWE-219: Storage of File with Sensitive Data Under Web Root •

CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter. Vulnderabilidad de secuencias de comandos en sitios cruzados (cross-site scripting) en Horde anteriores a 1.2.8 y IMP anteriores a 2.2.8 permite a atacantes remotos ejecutar scripts y robar cookies de otros usuarios. • http://bugs.horde.org/show_bug.cgi?id=916 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473 http://marc.info/?l=bugtraq&m=101828033830744&w=2 http://www.calderasystems.com/support/security/advisories/CSSA-2002-016.1.txt http://www.debian.org/security/2002/dsa-126 http://www.iss.net/security_center/static/8769.php http://www.osvdb.org/5345 http://www.securityfocus.com/bid/4444 •

CVSS: 2.1EPSS: 0%CPEs: 6EXPL: 0

Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file. • ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2001-025.0.txt http://archives.neohapsis.com/archives/bugtraq/2001-05/0303.html http://www.horde.org/imp/2.2/news.php •

CVSS: 3.6EPSS: 0%CPEs: 7EXPL: 1

Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000410 http://online.securityfocus.com/archive/1/198495 http://www.caldera.com/support/security/advisories/CSSA-2001-027.0.txt http://www.debian.org/security/2001/dsa-073 http://www.iss.net/security_center/static/6906.php http://www.securityfocus.com/bid/3083 •

CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 1

Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000410 http://online.securityfocus.com/archive/1/198495 http://www.caldera.com/support/security/advisories/CSSA-2001-027.0.txt http://www.debian.org/security/2001/dsa-073 http://www.iss.net/security_center/static/6905.php http://www.securityfocus.com/bid/3082 •