Product:

Groupware

(Horde)
Repositories • https://github.com/horde/horde
• https://github.com/horde/kronolith
• https://github.com/horde/base
#Vulnerabilities 43
Date Id Summary Products Score Patch Annotated
2007-03-26 CVE-2007-1679 Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages Groupware N/A
2020-02-17 CVE-2020-8518 Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. Debian_linux, Fedora, Groupware 9.8
2020-03-23 CVE-2020-8865 This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the... Debian_linux, Groupware 6.3