CVSS: 4.9EPSS: 0%CPEs: 16EXPL: 0CVE-2008-0807
https://notcve.org/view.php?id=CVE-2008-0807
lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book. lib/Driver/sql.php en Turba 2 (turba2) Contact Manager H3 2.1.x antes de 2.1.7 y 2.2.x antes de 2.2-RC3, como se usa en productos como Horde Groupware antes de 1.0.4 y Horde Groupware Webmail Edition antes de 1.0.5, no comprueba correctamente los privilegios de acceso, lo que permite a usuarios autentificados remotamente modificar datos de dirección a través de un parámetro object_id modificado a edit.php, como se demostró modificando una entrada personal en la libreta de direcciones cuando hay un acceso de escritura a una libreta de direcciones compartida. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 http://lists.horde.org/archives/announce/2008/000378.html http://lists.horde.org/archives/announce/2008/000379.html http://lists.horde.org/archives/announce/2008/000380.html http://lists.horde.org/archives/announce/2008/000381.html http://secunia.com/advisories/28982 http://secunia.com/advisories/29071 http://secunia.com/advisories/29184 http://secunia.com/advisories/29185 http://secunia.com/advisories/29186 http:// • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1679
https://notcve.org/view.php?id=CVE-2007-1679
Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages ** DISPUTADA ** Múltiples vulnerabilidades de XSS en Horde Groupware Webmail 1.0 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados en (1) imp/search.php y (2) ingo/rule.php. NOTA: este problema ha sido disputado por el proveedor, anotando que el problema de search.php fue resuelto en CVE-2006-4255, y atacantes solo pueden utilizar rule.php para inyectar XSS en sus propias páginas. • http://securityreason.com/securityalert/2487 http://www.securityfocus.com/archive/1/463819/100/0/threaded http://www.securityfocus.com/archive/1/463911/100/0/threaded http://www.securityfocus.com/bid/23136 https://exchange.xforce.ibmcloud.com/vulnerabilities/33228 •
CVSS: 5.1EPSS: 4%CPEs: 2EXPL: 0CVE-2007-0579
https://notcve.org/view.php?id=CVE-2007-0579
Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors. NOTE: some of these details are obtained from third party information. Vulnerabilidad no especificada en el componente de calendario en Horde Groupware Webmail Edition versiones anteriores a 1.0, y Groupware before 1.0, permite a atacantes remotos incluir ficheros concretos mediante vectores desconocidos. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://lists.horde.org/archives/announce/2007/000308.html http://lists.horde.org/archives/announce/2007/000309.html http://osvdb.org/33083 http://www.securityfocus.com/bid/22273 http://www.vupen.com/english/advisories/2007/0368 https://exchange.xforce.ibmcloud.com/vulnerabilities/31849 •