Summary
Detail | |||
---|---|---|---|
Vendor | Horde | First view | 2008-01-10 |
Product | Groupware Webmail Edition | Last view | 2012-01-24 |
Version | Type | ||
Update | |||
Edition | |||
Language | |||
Sofware Edition | |||
Target Software | |||
Target Hardware | |||
Other |
Activity : Overall
COMMON PLATFORM ENUMERATION: Repartition per Version
Related : CVE
Date | Alert | Description | |
---|---|---|---|
4.3 | 2012-01-24 | CVE-2012-0909 | Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information. |
4.3 | 2012-01-24 | CVE-2012-0791 | Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information. |
10 | 2009-09-13 | CVE-2008-7219 | Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 does not validate ownership when performing share changes, which has unknown impact and attack vectors. |
10 | 2009-09-13 | CVE-2008-7218 | Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before 2.1.7 and H3 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and 2.2 before 2.2-RC2; Horde Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 has unknown impact and attack vectors. |
9 | 2008-08-12 | CVE-2008-3650 | Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related to "unescaped output," possibly cross-site scripting (XSS), in the (1) object browser and (2) contact view. |
4.3 | 2008-06-19 | CVE-2008-2783 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to (1) week.php, (2) workweek.php, and (3) day.php; and (4) the horde parameter in the PATH_INFO to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
4.3 | 2008-04-27 | CVE-2008-1974 | Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter. |
6 | 2008-03-10 | CVE-2008-1284 | Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name. |
4.9 | 2008-02-18 | CVE-2008-0807 | lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book. |
5.8 | 2008-01-10 | CVE-2007-6018 | IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
50% (4) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
37% (3) | CWE-264 | Permissions, Privileges, and Access Controls |
12% (1) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
CAPEC : Common Attack Pattern Enumeration & Classification
id | Name |
---|---|
CAPEC-3 | Using Leading 'Ghost' Character Sequences to Bypass Input Filters |
CAPEC-7 | Blind SQL Injection |
CAPEC-8 | Buffer Overflow in an API Call |
CAPEC-9 | Buffer Overflow in Local Command-Line Utilities |
CAPEC-10 | Buffer Overflow via Environment Variables |
CAPEC-13 | Subverting Environment Variable Values |
CAPEC-14 | Client-side Injection-induced Buffer Overflow |
CAPEC-18 | Embedding Scripts in Nonscript Elements |
CAPEC-22 | Exploiting Trust in Client (aka Make the Client Invisible) |
CAPEC-24 | Filter Failure through Buffer Overflow |
CAPEC-28 | Fuzzing |
CAPEC-31 | Accessing/Intercepting/Modifying HTTP Cookies |
CAPEC-32 | Embedding Scripts in HTTP Query Strings |
CAPEC-42 | MIME Conversion |
CAPEC-43 | Exploiting Multiple Input Interpretation Layers |
CAPEC-45 | Buffer Overflow via Symbolic Links |
CAPEC-46 | Overflow Variables and Tags |
CAPEC-47 | Buffer Overflow via Parameter Expansion |
CAPEC-52 | Embedding NULL Bytes |
CAPEC-53 | Postfix, Null Terminate, and Backslash |
CAPEC-63 | Simple Script Injection |
CAPEC-64 | Using Slashes and URL Encoding Combined to Bypass Validation Logic |
CAPEC-66 | SQL Injection |
CAPEC-67 | String Format Overflow in syslog() |
CAPEC-71 | Using Unicode Encoding to Bypass Validation Logic |
Oval Markup Language : Definitions
OvalID | Name |
---|---|
oval:org.mitre.oval:def:8124 | DSA-1470 horde3 -- missing input sanitising |
oval:org.mitre.oval:def:20374 | DSA-1470-1 horde3 - missing input sanitising |
oval:org.mitre.oval:def:8049 | DSA-1507 turba2 -- programming error |
oval:org.mitre.oval:def:18738 | DSA-1507-1 turba2 |
oval:org.mitre.oval:def:7854 | DSA-1519 horde3 -- insufficient input sanitising |
oval:org.mitre.oval:def:20302 | DSA-1519-1 horde3 - information disclosure |
oval:org.mitre.oval:def:8251 | DSA-1560 kronolith2 -- insufficient input sanitising |
oval:org.mitre.oval:def:18670 | DSA-1560-1 kronolith2 - cross site scripting |
oval:org.mitre.oval:def:19648 | DSA-2485-1 imp4 - cross site scripting |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
46702 | Horde Multiple Product day.php PATH_INFO XSS |
46701 | Horde Multiple Product workweek.php PATH_INFO XSS |
46700 | Horde Multiple Product week.php PATH_INFO XSS |
46380 | Horde Multiple Products Contact Views XSS |
46379 | Horde Multiple Products Object Browser Item Names XSS |
44557 | Kronolith addevent.php url Parameter XSS |
42779 | Horde Turba 2 (turba2) Contact Manager H3 lib/Driver/sql.php Unauthorized Dat... |
42776 | Horde Multiple Products Share Management Owner Validation Unspecified Issue |
42775 | Horde Multiple Products API Unspecified Privilege Escalation |
42774 | Horde Multiple Products theme Parameter Traversal Local File Inclusion |
42773 | Horde / IMP Mail Crafted E-mail Arbitrary Delete Mail Purge |
42772 | Horde / IMP Mail Crafted Numeric ID Arbitrary Mail Deletion |
OpenVAS Exploits
id | Description |
---|---|
2012-08-10 | Name : Debian Security Advisory DSA 2485-1 (imp4) File : nvt/deb_2485_1.nasl |
2012-08-02 | Name : SuSE Update for horde openSUSE-SU-2012:0287-1 (horde) File : nvt/gb_suse_2012_0287_1.nasl |
2012-08-02 | Name : SuSE Update for horde3 openSUSE-SU-2012:0286-1 (horde3) File : nvt/gb_suse_2012_0286_1.nasl |
2009-03-31 | Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl |
2009-02-17 | Name : Fedora Update for kronolith FEDORA-2008-3543 File : nvt/gb_fedora_2008_3543_kronolith_fc8.nasl |
2009-02-17 | Name : Fedora Update for kronolith FEDORA-2008-3460 File : nvt/gb_fedora_2008_3460_kronolith_fc7.nasl |
2009-02-16 | Name : Fedora Update for turba FEDORA-2008-2087 File : nvt/gb_fedora_2008_2087_turba_fc8.nasl |
2009-02-16 | Name : Fedora Update for horde FEDORA-2008-2406 File : nvt/gb_fedora_2008_2406_horde_fc7.nasl |
2009-02-16 | Name : Fedora Update for horde FEDORA-2008-2362 File : nvt/gb_fedora_2008_2362_horde_fc8.nasl |
2009-02-16 | Name : Fedora Update for kronolith FEDORA-2008-2212 File : nvt/gb_fedora_2008_2212_kronolith_fc7.nasl |
2009-02-16 | Name : Fedora Update for imp FEDORA-2008-2087 File : nvt/gb_fedora_2008_2087_imp_fc8.nasl |
2009-02-16 | Name : Fedora Update for horde FEDORA-2008-2087 File : nvt/gb_fedora_2008_2087_horde_fc8.nasl |
2009-02-16 | Name : Fedora Update for turba FEDORA-2008-2040 File : nvt/gb_fedora_2008_2040_turba_fc7.nasl |
2009-02-16 | Name : Fedora Update for imp FEDORA-2008-2040 File : nvt/gb_fedora_2008_2040_imp_fc7.nasl |
2009-02-16 | Name : Fedora Update for horde FEDORA-2008-2040 File : nvt/gb_fedora_2008_2040_horde_fc7.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200802-03 (horde-imp) File : nvt/glsa_200802_03.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200805-01 (horde) File : nvt/glsa_200805_01.nasl |
2008-04-30 | Name : Debian Security Advisory DSA 1560-1 (kronolith2) File : nvt/deb_1560_1.nasl |
2008-03-19 | Name : Debian Security Advisory DSA 1519-1 (horde3) File : nvt/deb_1519_1.nasl |
2008-02-28 | Name : Debian Security Advisory DSA 1507-1 (turba2) File : nvt/deb_1507_1.nasl |
2008-01-31 | Name : Debian Security Advisory DSA 1470-1 (horde3) File : nvt/deb_1470_1.nasl |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2014-06-13 | Name: The remote openSUSE host is missing a security update. File: suse_11_4_horde3-imp-120217.nasl - Type: ACT_GATHER_INFO |
2014-06-13 | Name: The remote openSUSE host is missing a security update. File: suse_11_4_horde3-dimp-120217.nasl - Type: ACT_GATHER_INFO |
2014-06-13 | Name: The remote openSUSE host is missing a security update. File: suse_11_4_horde3-120217.nasl - Type: ACT_GATHER_INFO |
2014-06-13 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2012-112.nasl - Type: ACT_GATHER_INFO |
2014-06-13 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2012-111.nasl - Type: ACT_GATHER_INFO |
2012-06-29 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-2485.nasl - Type: ACT_GATHER_INFO |
2009-07-21 | Name: The remote openSUSE host is missing a security update. File: suse_11_0_imp-090318.nasl - Type: ACT_GATHER_INFO |
2009-07-21 | Name: The remote openSUSE host is missing a security update. File: suse_11_0_horde-081119.nasl - Type: ACT_GATHER_INFO |
2009-03-24 | Name: The remote openSUSE host is missing a security update. File: suse_imp-6101.nasl - Type: ACT_GATHER_INFO |
2008-11-25 | Name: The remote openSUSE host is missing a security update. File: suse_horde-5791.nasl - Type: ACT_GATHER_INFO |
2008-06-12 | Name: The remote Fedora host is missing a security update. File: fedora_2008-3543.nasl - Type: ACT_GATHER_INFO |
2008-06-12 | Name: The remote Fedora host is missing a security update. File: fedora_2008-3460.nasl - Type: ACT_GATHER_INFO |
2008-05-09 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-200805-01.nasl - Type: ACT_GATHER_INFO |
2008-05-01 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-1560.nasl - Type: ACT_GATHER_INFO |
2008-03-17 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-1519.nasl - Type: ACT_GATHER_INFO |
2008-03-13 | Name: The remote Fedora host is missing a security update. File: fedora_2008-2406.nasl - Type: ACT_GATHER_INFO |
2008-03-13 | Name: The remote Fedora host is missing a security update. File: fedora_2008-2362.nasl - Type: ACT_GATHER_INFO |
2008-03-07 | Name: The remote Fedora host is missing a security update. File: fedora_2008-2212.nasl - Type: ACT_GATHER_INFO |
2008-02-29 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2008-2087.nasl - Type: ACT_GATHER_INFO |
2008-02-29 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2008-2040.nasl - Type: ACT_GATHER_INFO |
2008-02-25 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-1507.nasl - Type: ACT_GATHER_INFO |
2008-02-12 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-200802-03.nasl - Type: ACT_GATHER_INFO |
2008-01-27 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-1470.nasl - Type: ACT_GATHER_INFO |