CVSS: 4.3EPSS: 0%CPEs: 31EXPL: 0CVE-2012-5565
https://notcve.org/view.php?id=CVE-2012-5565
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view. Vulnerabilidad de XSS en js/compose-dimp.js en Horde Internet Mail Program (IMP) anterior a 5.0.24, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un nombre manipulado para un archivo adjunto, relacionado con la visualización dinámica. • http://lists.horde.org/archives/announce/2012/000833.html http://lists.horde.org/archives/announce/2012/000840.html http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html http://www.openwall.com/lists/oss-security/2012/11/23/6 https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0CVE-2012-6640
https://notcve.org/view.php?id=CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565. Vulnerabilidad de XSS en Horde Internet Mail Program (IMP) anterior a 5.0.22, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un adjunto de imagen SVG manipulado, una vulnerabilidad diferente a CVE-2012-5565. • http://lists.horde.org/archives/announce/2012/000775.html http://lists.horde.org/archives/announce/2012/000840.html https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 128EXPL: 0CVE-2012-0791
https://notcve.org/view.php?id=CVE-2012-0791
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information. Múltiples vulnerbilidades de ejecución de secuencias de comandos web en sitios cruzados (XSS) en Horde IMP anterior a v5.0.18 y Horde Groupware Webmail Edition anterior a v4.0.6 permite a atacantes remotos inyectar código HTML o script web a través de los parámetros que componen la página (1) composeCache, (2) rtemode, o (3) filename_*;(4) parámetro formname para ventanas popup; o (5) nombres de buzón IMAP. NOTA: Algunos de estos detalles han sido obtenidos de terceras partes de información. • http://secunia.com/advisories/47580 http://secunia.com/advisories/47592 http://www.debian.org/security/2012/dsa-2485 http://www.horde.org/apps/imp/docs/CHANGES http://www.horde.org/apps/imp/docs/RELEASE_NOTES http://www.horde.org/apps/webmail/docs/CHANGES http://www.horde.org/apps/webmail/docs/RELEASE_NOTES http://www.openwall.com/lists/oss-security/2012/01/22/2 http://www.securityfocus.com/bid/51586 http://www.securitytracker.com/id?1026553 http://w • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •