CVSS: 9.8EPSS: 94%CPEs: 6EXPL: 4CVE-2014-1691 – Horde Framework - Unserialize PHP Code Execution
https://notcve.org/view.php?id=CVE-2014-1691
06 Feb 2014 — The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form. El script framework/Util/lib/Horde/Variables.php en la libraría de Util en Horde anterior a 5.1.1 permite a atacantes remotos realizar ataques de inyección de objetos y ejecutar código PHP arbitrario a través de un objeto serializado manipulado en el formulario _formvars. P... • https://packetstorm.news/files/id/125812 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 84EXPL: 0CVE-2010-3694
https://notcve.org/view.php?id=CVE-2010-3694
09 Nov 2010 — Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Horde Application Framework anterior a v3.3.9 permite a los atacantes remotos secuestrar la autenticación de víctimas sin especificar en peticiones a un formulario preferente. • http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 84EXPL: 2CVE-2010-3077 – Horde Application Framework 3.3.8 - 'icon_browser.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-3077
09 Nov 2010 — Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML via the subdir parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en util/icon_browser.php en el Horde Application Framework anterior a v3.3.9 que permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través del parámetro "subdir". • https://www.exploit-db.com/exploits/34605 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 24EXPL: 1CVE-2007-1474 – Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2007-1474
16 Mar 2007 — Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames. Vulnerabilidad de inyección de argumento en la secuencia de comandos cleanup para cron de Horde Project Horde e IMP anterior a Horde Application Framework 3.1.4 permite a usuarios locales borrar archivos de su elección y posiblemente obtener privilegios mediante múl... • https://www.exploit-db.com/exploits/29746 •
CVSS: 6.1EPSS: 1%CPEs: 37EXPL: 1CVE-2007-1473 – Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1473
16 Mar 2007 — Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en framework/NLS/NLS.php en Horde Framework anterior a 3.1.4 RC1, cuando la página de login contiene una caja de elección de idioma, permite a atacantes remotos inyectar secuencias de c... • https://www.exploit-db.com/exploits/29745 •
CVSS: 5.3EPSS: 1%CPEs: 13EXPL: 3CVE-2006-3549
https://notcve.org/view.php?id=CVE-2006-3549
13 Jul 2006 — services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server. services/go.php en Horde Application Framework 3.0.0 hasta la 3.0.10 y 3.1.0 hasta la 3.1.1 no restringe de forma adecuada su capacidad de imagen de proxy, lo cual permite... • http://lists.horde.org/archives/announce/2006/000287.html •
CVSS: 5.4EPSS: 0%CPEs: 43EXPL: 0CVE-2005-4190
https://notcve.org/view.php?id=CVE-2005-4190
13 Dec 2005 — Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag. Múltiples vulnerabilidades de secuencias de comand... • http://lists.horde.org/archives/announce/2005/000238.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •