Page 5 of 25 results (0.011 seconds)

CVSS: 10.0EPSS: 1%CPEs: 24EXPL: 0

CVE-2008-7219

https://notcve.org/view.php?id=CVE-2008-7219

Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 does not validate ownership when performing share changes, which has unknown impact and attack vectors. Horde Kronolith H3 v2.1 anterior v2.1.7 y v2.2 anterior v2.2-RC2; Nag H3 v2.1 anterior v2.1.4 y 2.2 anterior v2.2-RC2; Mnemo H3 v2.1 anterior v2.1.2 y H3 2.2 anterior v2.2-RC2; Groupware v1.0 anterior v1.0.3 y v1.1 anterior v1.1-RC2; y Groupware Webmail Edition v1.0 anterior v1.0.4 y v1.1 anterior v1.1-RC2, no valida las propiedades al compartir cambios, con un impacto y vectores de ataque desconocidos. • http://lists.horde.org/archives/announce/2008/000362.html http://lists.horde.org/archives/announce/2008/000363.html http://lists.horde.org/archives/announce/2008/000364.html http://lists.horde.org/archives/announce/2008/000365.html http://lists.horde.org/archives/announce/2008/000366.html http://lists.horde.org/archives/announce/2008/000368.html http://lists.horde.org/archives/announce/2008/000369.html http://lists.horde.org/archives/announce/2008/000371.html http://lists.horde • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 10.0EPSS: 1%CPEs: 39EXPL: 0

CVE-2008-7218

https://notcve.org/view.php?id=CVE-2008-7218

Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before 2.1.7 and H3 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and 2.2 before 2.2-RC2; Horde Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 has unknown impact and attack vectors. Vulnerabilidad no especificada en el API de Horde v3.1 anterior a v3.1.6 y v3.2 anterior a v3.2 anterior a v3.2-RC2; Turba H3 v2.1 anterior a v2.1.6 y v2.2 anterior a v2.2-RC2; Kronolith H3 2.1 anterior a v2.1.7 y H3 v2.2 anterior a v2.2-RC2; Nag H3 v2.1 anterior a v2.1.4 y v2.2 anterior a v2.2-RC2; Mnemo H3 v2.1 anterior a v2.1.2 y v2.2 anterior a v2.2-RC2; Horde Groupware v1.0 anterior a v1.0.3 y v1.1 anterior a v1.1-RC2; y Groupware Webmail Edition v1.0 anterior a v1.0.4 y v1.1 anterior a v1.1-RC2; tiene impacto y vectores de ataque desconocidos. • http://lists.horde.org/archives/announce/2008/000360.html http://lists.horde.org/archives/announce/2008/000361.html http://lists.horde.org/archives/announce/2008/000362.html http://lists.horde.org/archives/announce/2008/000363.html http://lists.horde.org/archives/announce/2008/000364.html http://lists.horde.org/archives/announce/2008/000365.html http://lists.horde.org/archives/announce/2008/000366.html http://lists.horde.org/archives/announce/2008/000367.html http://lists.horde •

CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2008-1284

https://notcve.org/view.php?id=CVE-2008-1284

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name. Vulnerabilidad de salto de directorio en Horde 3.1.6, Groupware anterior 1.0.5, y Groupware Webmail Edition anterior 1.0.6, cuando ejecuta ciertas configuraciones, pertmite a usuarios autenticados remotamente leer y ejecutar ficheros de su elección a través de secuencias ".." y de byte nulo en el mismo "theme name". • http://lists.horde.org/archives/announce/2008/000382.html http://lists.horde.org/archives/announce/2008/000383.html http://lists.horde.org/archives/announce/2008/000384.html http://secunia.com/advisories/29286 http://secunia.com/advisories/29374 http://secunia.com/advisories/29400 http://secunia.com/advisories/30047 http://security.gentoo.org/glsa/glsa-200805-01.xml http://securityreason.com/securityalert/3726 http://www.debian.org/security/2008/dsa-1519 http://www.securityf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 4.9EPSS: 0%CPEs: 16EXPL: 0

CVE-2008-0807

https://notcve.org/view.php?id=CVE-2008-0807

lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book. lib/Driver/sql.php en Turba 2 (turba2) Contact Manager H3 2.1.x antes de 2.1.7 y 2.2.x antes de 2.2-RC3, como se usa en productos como Horde Groupware antes de 1.0.4 y Horde Groupware Webmail Edition antes de 1.0.5, no comprueba correctamente los privilegios de acceso, lo que permite a usuarios autentificados remotamente modificar datos de dirección a través de un parámetro object_id modificado a edit.php, como se demostró modificando una entrada personal en la libreta de direcciones cuando hay un acceso de escritura a una libreta de direcciones compartida. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 http://lists.horde.org/archives/announce/2008/000378.html http://lists.horde.org/archives/announce/2008/000379.html http://lists.horde.org/archives/announce/2008/000380.html http://lists.horde.org/archives/announce/2008/000381.html http://secunia.com/advisories/28982 http://secunia.com/advisories/29071 http://secunia.com/advisories/29184 http://secunia.com/advisories/29185 http://secunia.com/advisories/29186 http:// • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2007-1679

https://notcve.org/view.php?id=CVE-2007-1679

Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages ** DISPUTADA ** Múltiples vulnerabilidades de XSS en Horde Groupware Webmail 1.0 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados en (1) imp/search.php y (2) ingo/rule.php. NOTA: este problema ha sido disputado por el proveedor, anotando que el problema de search.php fue resuelto en CVE-2006-4255, y atacantes solo pueden utilizar rule.php para inyectar XSS en sus propias páginas. • http://securityreason.com/securityalert/2487 http://www.securityfocus.com/archive/1/463819/100/0/threaded http://www.securityfocus.com/archive/1/463911/100/0/threaded http://www.securityfocus.com/bid/23136 https://exchange.xforce.ibmcloud.com/vulnerabilities/33228 •