CVSS: 10.0EPSS: 1%CPEs: 24EXPL: 0CVE-2008-7219
https://notcve.org/view.php?id=CVE-2008-7219
Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 does not validate ownership when performing share changes, which has unknown impact and attack vectors. Horde Kronolith H3 v2.1 anterior v2.1.7 y v2.2 anterior v2.2-RC2; Nag H3 v2.1 anterior v2.1.4 y 2.2 anterior v2.2-RC2; Mnemo H3 v2.1 anterior v2.1.2 y H3 2.2 anterior v2.2-RC2; Groupware v1.0 anterior v1.0.3 y v1.1 anterior v1.1-RC2; y Groupware Webmail Edition v1.0 anterior v1.0.4 y v1.1 anterior v1.1-RC2, no valida las propiedades al compartir cambios, con un impacto y vectores de ataque desconocidos. • http://lists.horde.org/archives/announce/2008/000362.html http://lists.horde.org/archives/announce/2008/000363.html http://lists.horde.org/archives/announce/2008/000364.html http://lists.horde.org/archives/announce/2008/000365.html http://lists.horde.org/archives/announce/2008/000366.html http://lists.horde.org/archives/announce/2008/000368.html http://lists.horde.org/archives/announce/2008/000369.html http://lists.horde.org/archives/announce/2008/000371.html http://lists.horde • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2008-3650
https://notcve.org/view.php?id=CVE-2008-3650
Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related to "unescaped output," possibly cross-site scripting (XSS), in the (1) object browser and (2) contact view. Múltiples vulnerabilidades no especificadas en Horde Groupware Webmail anterior a Edition 1.1.1 (final) tiene impacto desconocido y vectores de ataque relacionados con "salida no escapada", posiblemente secuencias de comandos en sitios cruzados (XSS) en (1) el navegador objeto y (2) la vista de contacto. • http://lists.horde.org/archives/announce/2008/000420.html https://exchange.xforce.ibmcloud.com/vulnerabilities/44479 •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 4CVE-2008-2783 – Horde Multiple Product - 'day.php?Timestamp' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-2783
Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to (1) week.php, (2) workweek.php, and (3) day.php; and (4) the horde parameter in the PATH_INFO to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de secuencia de comandos en sitios cruzados (XSS) en Horde Groupware, Groupware Webmail Edition y Kronolith, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro timestamp en (1) week.php, (2) workweek.php y (3) day.php; y (4) parámetro horde en PATH_INFO de la URI por defeceto. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • https://www.exploit-db.com/exploits/31840 https://www.exploit-db.com/exploits/31839 https://www.exploit-db.com/exploits/31838 http://www.securityfocus.com/bid/29365 https://exchange.xforce.ibmcloud.com/vulnerabilities/42640 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 3CVE-2008-1974 – Horde Webmail 1.0.6 - 'addevent.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1974
Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter. Vulnerabilidad de secuencias de órdenes en sitios cruzados (XSS) en addevent.php de Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, y Groupware 1.0.5 permite a atacantes remotos inyectar 'script' web o HTML de su elección mediante el parámetro "url". • https://www.exploit-db.com/exploits/31697 http://forum.aria-security.com/showthread.php?t=49 http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html http://osvdb.org/51238 http://secunia.com/advisories/29920 http://secunia.com/advisories/30649 http://securityreason.com/securityalert/3831 http://www.securityfocus.com/archive/1/491230/100/0/threaded http://www.securityfocus.com/bid/28898 http://www.securitytracker.com/id?1019934 http://www.vupen.com/eng • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2008-1284
https://notcve.org/view.php?id=CVE-2008-1284
Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name. Vulnerabilidad de salto de directorio en Horde 3.1.6, Groupware anterior 1.0.5, y Groupware Webmail Edition anterior 1.0.6, cuando ejecuta ciertas configuraciones, pertmite a usuarios autenticados remotamente leer y ejecutar ficheros de su elección a través de secuencias ".." y de byte nulo en el mismo "theme name". • http://lists.horde.org/archives/announce/2008/000382.html http://lists.horde.org/archives/announce/2008/000383.html http://lists.horde.org/archives/announce/2008/000384.html http://secunia.com/advisories/29286 http://secunia.com/advisories/29374 http://secunia.com/advisories/29400 http://secunia.com/advisories/30047 http://security.gentoo.org/glsa/glsa-200805-01.xml http://securityreason.com/securityalert/3726 http://www.debian.org/security/2008/dsa-1519 http://www.securityf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •