Search criteria
67 vulnerabilities found for IMP by Horde
CVE-2025-30349 (GCVE-0-2025-30349)
Vulnerability from cvelistv5 – Published: 2025-03-21 00:00 – Updated: 2025-04-03 19:57
VLAI?
Summary
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30349",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T19:57:19.164722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T19:57:27.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-04-03T12:04:26.080Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IMP",
"vendor": "Horde",
"versions": [
{
"lessThanOrEqual": "6.2.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.2.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T00:01:10.320Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/horde/webmail/releases/tag/v5.2.22"
},
{
"url": "https://www.horde.org/apps/imp"
},
{
"url": "https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html"
},
{
"url": "https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html"
},
{
"url": "https://www.horde.org/download/horde"
},
{
"url": "https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62"
},
{
"url": "https://www.horde.org/apps/horde"
},
{
"url": "https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25"
},
{
"url": "https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html"
},
{
"url": "https://github.com/horde/imp/releases/tag/v6.2.27"
},
{
"url": "https://github.com/horde/base/releases/tag/v5.2.23"
},
{
"url": "https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html"
},
{
"url": "https://github.com/natasaka/CVE-2025-30349/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-30349",
"datePublished": "2025-03-21T00:00:00.000Z",
"dateReserved": "2025-03-21T00:00:00.000Z",
"dateUpdated": "2025-04-03T19:57:27.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6640 (GCVE-0-2012-6640)
Vulnerability from cvelistv5 – Published: 2014-04-05 21:00 – Updated: 2024-09-16 17:14
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:01.866Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-04-05T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6640",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"name": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc",
"refsource": "CONFIRM",
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6640",
"datePublished": "2014-04-05T21:00:00Z",
"dateReserved": "2014-04-05T00:00:00Z",
"dateUpdated": "2024-09-16T17:14:04.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5565 (GCVE-0-2012-5565)
Vulnerability from cvelistv5 – Published: 2014-04-05 21:00 – Updated: 2024-08-06 21:14
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:14:15.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2012:1626",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-11-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-04-05T19:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "openSUSE-SU-2012:1626",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-5565",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2012:1626",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"name": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2",
"refsource": "CONFIRM",
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-5565",
"datePublished": "2014-04-05T21:00:00",
"dateReserved": "2012-10-24T00:00:00",
"dateUpdated": "2024-08-06T21:14:15.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-0791 (GCVE-0-2012-0791)
Vulnerability from cvelistv5 – Published: 2012-01-24 18:00 – Updated: 2024-08-06 18:38
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:38:14.284Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"name": "DSA-2485",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"name": "1026553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1026553"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"name": "51586",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/51586"
},
{
"name": "47580",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47580"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"name": "1026554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1026554"
},
{
"name": "[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"name": "47592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47592"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-17T19:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"name": "DSA-2485",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"name": "1026553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1026553"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"name": "51586",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/51586"
},
{
"name": "47580",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47580"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"name": "1026554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1026554"
},
{
"name": "[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"name": "47592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47592"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-0791",
"datePublished": "2012-01-24T18:00:00",
"dateReserved": "2012-01-19T00:00:00",
"dateUpdated": "2024-08-06T18:38:14.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4778 (GCVE-0-2010-4778)
Vulnerability from cvelistv5 – Published: 2011-04-01 21:00 – Updated: 2024-09-17 03:12
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:55:35.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-04-01T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4778",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11",
"refsource": "CONFIRM",
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4778",
"datePublished": "2011-04-01T21:00:00Z",
"dateReserved": "2011-04-01T00:00:00Z",
"dateUpdated": "2024-09-17T03:12:55.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-3695 (GCVE-0-2010-3695)
Vulnerability from cvelistv5 – Published: 2011-03-31 22:00 – Updated: 2024-08-07 03:18
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:18:52.953Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"name": "43515",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"name": "DSA-2204",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "[oss-security] 20101001 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"name": "[announce] 20100928 IMP H3 (4.3.8) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"name": "ADV-2011-0769",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"name": "8170",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8170"
},
{
"name": "41627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"name": "43896",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43896"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"name": "43515",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"name": "DSA-2204",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "[oss-security] 20101001 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"name": "[announce] 20100928 IMP H3 (4.3.8) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"name": "ADV-2011-0769",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"name": "8170",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8170"
},
{
"name": "41627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"name": "43896",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43896"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-3695",
"datePublished": "2011-03-31T22:00:00",
"dateReserved": "2010-10-01T00:00:00",
"dateUpdated": "2024-08-07T03:18:52.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-0463 (GCVE-0-2010-0463)
Vulnerability from cvelistv5 – Published: 2010-01-29 18:00 – Updated: 2024-08-07 00:52
VLAI?
Summary
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:52:19.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "horde-dns-info-disclosure(56052)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.horde.org/ticket/8836"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "horde-dns-info-disclosure(56052)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.horde.org/ticket/8836"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-0463",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "horde-dns-info-disclosure(56052)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"name": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail",
"refsource": "MISC",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"name": "http://bugs.horde.org/ticket/8836",
"refsource": "CONFIRM",
"url": "http://bugs.horde.org/ticket/8836"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-0463",
"datePublished": "2010-01-29T18:00:00",
"dateReserved": "2010-01-29T00:00:00",
"dateUpdated": "2024-08-07T00:52:19.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-6018 (GCVE-0-2007-6018)
Vulnerability from cvelistv5 – Published: 2008-01-11 02:00 – Updated: 2024-08-07 15:54
VLAI?
Summary
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:54:25.651Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "29186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29186"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-01-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) \"purge\" deleted emails via a crafted email message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "29186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29186"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2007-6018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) \"purge\" deleted emails via a crafted email message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "29186",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29186"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=428625",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"name": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h",
"refsource": "CONFIRM",
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"name": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h",
"refsource": "CONFIRM",
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"name": "http://secunia.com/secunia_research/2007-102/advisory/",
"refsource": "MISC",
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2007-6018",
"datePublished": "2008-01-11T02:00:00",
"dateReserved": "2007-11-19T00:00:00",
"dateUpdated": "2024-08-07T15:54:25.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1515 (GCVE-0-2007-1515)
Vulnerability from cvelistv5 – Published: 2007-03-20 10:00 – Updated: 2024-08-07 12:59
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:59:08.400Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017774",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22975"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017774",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22975"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1515",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017774",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22975"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1515",
"datePublished": "2007-03-20T10:00:00",
"dateReserved": "2007-03-20T00:00:00",
"dateUpdated": "2024-08-07T12:59:08.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1474 (GCVE-0-2007-1474)
Vulnerability from cvelistv5 – Published: 2007-03-16 21:00 – Updated: 2024-08-07 12:59
VLAI?
Summary
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:59:08.403Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20070315 Horde Project Cleanup Script Arbitrary File Deletion Vulnerability",
"tags": [
"third-party-advisory",
"x_refsource_IDEFENSE",
"x_transferred"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489"
},
{
"name": "1017784",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017784"
},
{
"name": "27565",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27565"
},
{
"name": "horde-cron-file-deletion(32997)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32997"
},
{
"name": "22985",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22985"
},
{
"name": "1017785",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017785"
},
{
"name": "DSA-1406",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2007/dsa-1406"
},
{
"name": "ADV-2007-0965",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0965"
},
{
"name": "[announce] 20070314 Horde 3.1.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2007/000315.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20070315 Horde Project Cleanup Script Arbitrary File Deletion Vulnerability",
"tags": [
"third-party-advisory",
"x_refsource_IDEFENSE"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489"
},
{
"name": "1017784",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017784"
},
{
"name": "27565",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27565"
},
{
"name": "horde-cron-file-deletion(32997)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32997"
},
{
"name": "22985",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22985"
},
{
"name": "1017785",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017785"
},
{
"name": "DSA-1406",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2007/dsa-1406"
},
{
"name": "ADV-2007-0965",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0965"
},
{
"name": "[announce] 20070314 Horde 3.1.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2007/000315.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1474",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20070315 Horde Project Cleanup Script Arbitrary File Deletion Vulnerability",
"refsource": "IDEFENSE",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489"
},
{
"name": "1017784",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017784"
},
{
"name": "27565",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27565"
},
{
"name": "horde-cron-file-deletion(32997)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32997"
},
{
"name": "22985",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22985"
},
{
"name": "1017785",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017785"
},
{
"name": "DSA-1406",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2007/dsa-1406"
},
{
"name": "ADV-2007-0965",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0965"
},
{
"name": "[announce] 20070314 Horde 3.1.4 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2007/000315.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1474",
"datePublished": "2007-03-16T21:00:00",
"dateReserved": "2007-03-16T00:00:00",
"dateUpdated": "2024-08-07T12:59:08.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-30349 (GCVE-0-2025-30349)
Vulnerability from nvd – Published: 2025-03-21 00:00 – Updated: 2025-04-03 19:57
VLAI?
Summary
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Severity ?
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30349",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T19:57:19.164722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T19:57:27.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-04-03T12:04:26.080Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IMP",
"vendor": "Horde",
"versions": [
{
"lessThanOrEqual": "6.2.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.2.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T00:01:10.320Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/horde/webmail/releases/tag/v5.2.22"
},
{
"url": "https://www.horde.org/apps/imp"
},
{
"url": "https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html"
},
{
"url": "https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html"
},
{
"url": "https://www.horde.org/download/horde"
},
{
"url": "https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62"
},
{
"url": "https://www.horde.org/apps/horde"
},
{
"url": "https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25"
},
{
"url": "https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html"
},
{
"url": "https://github.com/horde/imp/releases/tag/v6.2.27"
},
{
"url": "https://github.com/horde/base/releases/tag/v5.2.23"
},
{
"url": "https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html"
},
{
"url": "https://github.com/natasaka/CVE-2025-30349/"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-30349",
"datePublished": "2025-03-21T00:00:00.000Z",
"dateReserved": "2025-03-21T00:00:00.000Z",
"dateUpdated": "2025-04-03T19:57:27.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6640 (GCVE-0-2012-6640)
Vulnerability from nvd – Published: 2014-04-05 21:00 – Updated: 2024-09-16 17:14
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:01.866Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-04-05T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6640",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[announce] 20120626 IMP H4 (5.0.22) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"name": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc",
"refsource": "CONFIRM",
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6640",
"datePublished": "2014-04-05T21:00:00Z",
"dateReserved": "2014-04-05T00:00:00Z",
"dateUpdated": "2024-09-16T17:14:04.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5565 (GCVE-0-2012-5565)
Vulnerability from nvd – Published: 2014-04-05 21:00 – Updated: 2024-08-06 21:14
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:14:15.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2012:1626",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-11-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-04-05T19:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "openSUSE-SU-2012:1626",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-5565",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2012:1626",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"name": "[announce] 20121114 IMP H4 (5.0.24) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"name": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2",
"refsource": "CONFIRM",
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"name": "[oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments.",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"name": "[announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-5565",
"datePublished": "2014-04-05T21:00:00",
"dateReserved": "2012-10-24T00:00:00",
"dateUpdated": "2024-08-06T21:14:15.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-0791 (GCVE-0-2012-0791)
Vulnerability from nvd – Published: 2012-01-24 18:00 – Updated: 2024-08-06 18:38
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:38:14.284Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"name": "DSA-2485",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"name": "1026553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1026553"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"name": "51586",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/51586"
},
{
"name": "47580",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47580"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"name": "1026554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1026554"
},
{
"name": "[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"name": "47592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47592"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-17T19:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"name": "DSA-2485",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"name": "1026553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1026553"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"name": "51586",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/51586"
},
{
"name": "47580",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47580"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"name": "1026554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1026554"
},
{
"name": "[oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"name": "47592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47592"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-0791",
"datePublished": "2012-01-24T18:00:00",
"dateReserved": "2012-01-19T00:00:00",
"dateUpdated": "2024-08-06T18:38:14.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4778 (GCVE-0-2010-4778)
Vulnerability from nvd – Published: 2011-04-01 21:00 – Updated: 2024-09-17 03:12
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:55:35.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-04-01T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4778",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11",
"refsource": "CONFIRM",
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "ADV-2010-2513",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4778",
"datePublished": "2011-04-01T21:00:00Z",
"dateReserved": "2011-04-01T00:00:00Z",
"dateUpdated": "2024-09-17T03:12:55.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-3695 (GCVE-0-2010-3695)
Vulnerability from nvd – Published: 2011-03-31 22:00 – Updated: 2024-08-07 03:18
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:18:52.953Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"name": "43515",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"name": "DSA-2204",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "[oss-security] 20101001 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"name": "[announce] 20100928 IMP H3 (4.3.8) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"name": "ADV-2011-0769",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"name": "8170",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8170"
},
{
"name": "41627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"name": "43896",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43896"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"name": "43515",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"name": "DSA-2204",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"name": "[oss-security] 20101001 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"name": "20100927 XSS in Horde IMP \u003c=4.3.7, fetchmailprefs.php",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"name": "[announce] 20100928 IMP H3 (4.3.8) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"name": "ADV-2011-0769",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"name": "8170",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8170"
},
{
"name": "41627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
},
{
"name": "ADV-2010-2513",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"name": "[oss-security] 20100930 Re: CVE request: Horde Gollem \u003c1.1.2 XSS in view.php",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"name": "43896",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43896"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-3695",
"datePublished": "2011-03-31T22:00:00",
"dateReserved": "2010-10-01T00:00:00",
"dateUpdated": "2024-08-07T03:18:52.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-0463 (GCVE-0-2010-0463)
Vulnerability from nvd – Published: 2010-01-29 18:00 – Updated: 2024-08-07 00:52
VLAI?
Summary
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:52:19.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "horde-dns-info-disclosure(56052)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.horde.org/ticket/8836"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "horde-dns-info-disclosure(56052)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.horde.org/ticket/8836"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-0463",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "horde-dns-info-disclosure(56052)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"name": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail",
"refsource": "MISC",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"name": "http://bugs.horde.org/ticket/8836",
"refsource": "CONFIRM",
"url": "http://bugs.horde.org/ticket/8836"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-0463",
"datePublished": "2010-01-29T18:00:00",
"dateReserved": "2010-01-29T00:00:00",
"dateUpdated": "2024-08-07T00:52:19.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-6018 (GCVE-0-2007-6018)
Vulnerability from nvd – Published: 2008-01-11 02:00 – Updated: 2024-08-07 15:54
VLAI?
Summary
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:54:25.651Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "29186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29186"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-01-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) \"purge\" deleted emails via a crafted email message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "29186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29186"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2007-6018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) \"purge\" deleted emails via a crafted email message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "29186",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29186"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=428625",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"name": "SUSE-SR:2009:007",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"name": "horde-impgroupware-filter-security-bypass(39595)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"name": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h",
"refsource": "CONFIRM",
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"name": "[announce] 20080109 Horde Groupware 1.0.3 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"name": "[announce] 20080109 Horde 3.1.6 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"name": "34418",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34418"
},
{
"name": "FEDORA-2008-2087",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"name": "27223",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/27223"
},
{
"name": "[announce] 20080110 Horde Groupware Webmail Edition 1.0.4 (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"name": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h",
"refsource": "CONFIRM",
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"name": "http://secunia.com/secunia_research/2007-102/advisory/",
"refsource": "MISC",
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"name": "28020",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28020"
},
{
"name": "29185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29185"
},
{
"name": "28546",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28546"
},
{
"name": "29184",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29184"
},
{
"name": "DSA-1470",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"name": "FEDORA-2008-2040",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2007-6018",
"datePublished": "2008-01-11T02:00:00",
"dateReserved": "2007-11-19T00:00:00",
"dateUpdated": "2024-08-07T15:54:25.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2007-1515 (GCVE-0-2007-1515)
Vulnerability from nvd – Published: 2007-03-20 10:00 – Updated: 2024-08-07 12:59
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:59:08.400Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017774",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22975"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017774",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22975"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1515",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017774",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017774"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"name": "[announce] 20070314 IMP H3 (4.1.4) (final)",
"refsource": "MLIST",
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"name": "20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"name": "ADV-2007-0964",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"name": "24541",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24541"
},
{
"name": "22975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22975"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1515",
"datePublished": "2007-03-20T10:00:00",
"dateReserved": "2007-03-20T00:00:00",
"dateUpdated": "2024-08-07T12:59:08.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201805-0227
Vulnerability from variot - Updated: 2024-05-17 19:19The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user's e-mail client. The discoverer can attack with this vulnerability "CBC/CFB gadget attack" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * CVE-2017-17688: OpenPGP CFB Attacks * CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, Articles provided by the discoverer Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201805-0227",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "webmail",
"scope": "eq",
"trust": 1.6,
"vendor": "roundcube",
"version": null
},
{
"model": "emclient",
"scope": "eq",
"trust": 1.0,
"vendor": "emclient",
"version": null
},
{
"model": "imp",
"scope": "eq",
"trust": 1.0,
"vendor": "horde",
"version": null
},
{
"model": "mail",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": null
},
{
"model": "postbox",
"scope": "eq",
"trust": 1.0,
"vendor": "postbox",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 1.0,
"vendor": "bloop",
"version": null
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 1.0,
"vendor": "mozilla",
"version": null
},
{
"model": "maildroid",
"scope": "eq",
"trust": 1.0,
"vendor": "flipdogsolutions",
"version": null
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 1.0,
"vendor": "r2mail2",
"version": null
},
{
"model": "mailmate",
"scope": "eq",
"trust": 1.0,
"vendor": "freron",
"version": null
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "2007"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "9folders",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "airmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "evolution",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "flipdog",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gpgtools",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gnupg",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "google",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "kmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mailmate",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mozilla",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "postbox",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "r2mail2",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ritlabs srl",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "roundcube",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the enigmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the horde",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "trojita",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "em client",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "round cube webmail",
"scope": "eq",
"trust": 0.3,
"vendor": "roundcube",
"version": "0"
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 0.3,
"vendor": "r2mail2",
"version": "0"
},
{
"model": "postbox",
"scope": "eq",
"trust": 0.3,
"vendor": "postbox",
"version": "0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.5.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.024"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.12"
},
{
"model": "thunderbird beta",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.52"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "9.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "9.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "8.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "7.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "7.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "5.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "38.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "32.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "23.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.23"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.22"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.21"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.1"
},
{
"model": "thunderbird beta",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.5"
},
{
"model": "outlook",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20070"
},
{
"model": "project horde imp",
"scope": "eq",
"trust": 0.3,
"vendor": "horde",
"version": "0"
},
{
"model": "solutions maildroid",
"scope": "eq",
"trust": 0.3,
"vendor": "flipdog",
"version": "0"
},
{
"model": "enigmail",
"scope": "eq",
"trust": 0.3,
"vendor": "enigmail",
"version": "0"
},
{
"model": "client em client",
"scope": "eq",
"trust": 0.3,
"vendor": "em",
"version": "0"
},
{
"model": "mail",
"scope": null,
"trust": 0.3,
"vendor": "apple",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 0.3,
"vendor": "airmail",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:roundcube:webmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Damian Poddebniak, Christian Dresen, Jens M\u00fcller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jorg Schwenk.",
"sources": [
{
"db": "BID",
"id": "104162"
}
],
"trust": 0.3
},
"cve": "CVE-2017-17688",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-108735",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-17688",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-17688",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201712-725",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-108735",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-17688",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user\u0027s e-mail client. The discoverer can attack with this vulnerability \"CBC/CFB gadget attack\" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * *CVE-2017-17688: OpenPGP CFB Attacks * *CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, \u003ca href=\"https://efail.de/efail-attack-paper.pdf\" target=\"blank\"\u003e Articles provided by the discoverer \u003c/a\u003e Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17688"
},
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-17688",
"trust": 2.9
},
{
"db": "BID",
"id": "104162",
"trust": 2.1
},
{
"db": "CERT/CC",
"id": "VU#122919",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1040904",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU95575473",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-108735",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-17688",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"id": "VAR-201805-0227",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
}
],
"trust": 0.01
},
"last_update_date": "2024-05-17T19:19:57.881000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Debian CVElist Bug Report Logs: enigmail: efail attack against enigmail",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=56a8018aac811c8d81b81ef5a6c3623a"
},
{
"title": "Red Hat: CVE-2017-17688",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-17688"
},
{
"title": "Efail-malleability-gadget-exploit",
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit "
},
{
"title": "more\nBoring bugs",
"trust": 0.1,
"url": "https://github.com/hannob/pgpbugs "
},
{
"title": "SecDB - Security Feeds",
"trust": 0.1,
"url": "https://github.com/giterlizzi/secdb-feeds "
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2018/05/14/smime_pgp_encryption_flaw_emails_vulnerable_to_snooping/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-17688"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-310",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://efail.de/"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/104162"
},
{
"trust": 1.8,
"url": "https://www.synology.com/support/security/synology_sa_18_22"
},
{
"trust": 1.8,
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"trust": 1.8,
"url": "https://efail.de"
},
{
"trust": 1.8,
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-may/060334.html"
},
{
"trust": 1.8,
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"trust": 1.8,
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"trust": 1.8,
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"trust": 1.8,
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id/1040904"
},
{
"trust": 1.6,
"url": "https://efail.de/efail-attack-paper.pdf"
},
{
"trust": 1.2,
"url": "https://www.kb.cert.org/vuls/id/122919"
},
{
"trust": 0.8,
"url": "https://tools.ietf.org/html/rfc4880"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17688"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu95575473/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17688"
},
{
"trust": 0.3,
"url": "https://www.openpgp.org/"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1577906"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-17688"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898630"
},
{
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-14T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULHUB",
"id": "VHN-108735"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"date": "2018-05-14T00:00:00",
"db": "BID",
"id": "104162"
},
{
"date": "2018-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2017-12-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"date": "2018-05-16T19:29:00.223000",
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-15T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-108735"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"date": "2018-05-15T10:00:00",
"db": "BID",
"id": "104162"
},
{
"date": "2018-08-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"date": "2024-05-17T01:16:13.807000",
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OpenPGP and S/MIME mail client vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
}
],
"trust": 0.6
}
}
VAR-201805-0228
Vulnerability from variot - Updated: 2024-02-13 20:51The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user's e-mail client. The discoverer can attack with this vulnerability "CBC/CFB gadget attack" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * CVE-2017-17688: OpenPGP CFB Attacks * CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, Articles provided by the discoverer Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4244-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff July 13, 2018 https://www.debian.org/security/faq
Package : thunderbird CVE ID : CVE-2017-17689 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or attacks on encrypted emails.
For the stable distribution (stretch), these problems have been fixed in version 1:52.9.1-1~deb9u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to its security tracker page at: https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltI+2sACgkQEMKTtsN8 TjZXHRAAgOmSvTwwmmzxRH/4tSSpndZCFCtkHrG5PU5D3XesLGnWpNZk9aINsaU2 ih3fmEKzQgHHfAzK3d9TcGjyiI+PoVuWkVknsVqTrHd+xQtxUs7B/5Pfz5WKiYDJ QJ4NhjTgHHystYa0j2CvK28/ZoPVZgwnc/D051ChTInPWXimJI+TxpsndW/NPuaJ SphoPP34OMO2EARjrKCxiL6NRv6kD4CJv0AgoYfdO0qPXomuA8HpDAH1itd7GbRq yVJoZRnpz9dGjJSM5wyFCc1BIqmA/CMphhmqiRTuFBA+rOSEDblzfc2tg9t82CVQ caA7rF3VrYx8qmgpP3akCju+SDOEWLerFGHH1iaQ+GBqiXvduvMl/MSXCZmVZzIC 92Ko2m9kURkak4yKccEbHJ5Vh8i0oLUOc+Ee3MUUfWUblYbCcB4z34p9hRwc8u83 mmGUbsq+qWvdcd9NkekKC/ENQZt4Egb3doeEzqSkaa4uhFaQ1gGosHXGslNTCqLl 6RyeFON9Q5CWphQET+rmnlcJ8B1cSHgpG1ZTN6szlsQpiVgcRu/JYrgyzX9Y6WdY rAape6t+gsEeLOP7n9pZ/KYSadUF5CvYY/nX9H6kJO1RmG9y0A+8wAEuW+nSOMMJ vh2U09+y5XJHQqV0MMTKbnadxlyi8Oerc0zrYaoBuYhR7wmvkus= =R2OH -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201805-0228",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "the bat",
"scope": "eq",
"trust": 1.6,
"vendor": "ritlabs",
"version": null
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.3,
"vendor": "microsoft",
"version": "2013"
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "2007"
},
{
"model": "kmail",
"scope": "eq",
"trust": 1.0,
"vendor": "kde",
"version": null
},
{
"model": "maildroid",
"scope": "eq",
"trust": 1.0,
"vendor": "flipdogsolutions",
"version": null
},
{
"model": "imp",
"scope": "eq",
"trust": 1.0,
"vendor": "horde",
"version": null
},
{
"model": "notes",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": null
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "2010"
},
{
"model": "trojita",
"scope": "eq",
"trust": 1.0,
"vendor": "kde",
"version": null
},
{
"model": "emclient",
"scope": "eq",
"trust": 1.0,
"vendor": "emclient",
"version": null
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "2016"
},
{
"model": "gmail",
"scope": "eq",
"trust": 1.0,
"vendor": "google",
"version": null
},
{
"model": "mailmate",
"scope": "eq",
"trust": 1.0,
"vendor": "freron",
"version": null
},
{
"model": "mail",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 1.0,
"vendor": "bloop",
"version": null
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 1.0,
"vendor": "mozilla",
"version": null
},
{
"model": "postbox",
"scope": "eq",
"trust": 1.0,
"vendor": "postbox",
"version": null
},
{
"model": "evolution",
"scope": "eq",
"trust": 1.0,
"vendor": "gnome",
"version": null
},
{
"model": "nine",
"scope": "eq",
"trust": 1.0,
"vendor": "9folders",
"version": null
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 1.0,
"vendor": "r2mail2",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "9folders",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "airmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "evolution",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "flipdog",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gpgtools",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gnupg",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "google",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "kmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mailmate",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mozilla",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "postbox",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "r2mail2",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ritlabs srl",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "roundcube",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the enigmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the horde",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "trojita",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "em client",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 0.3,
"vendor": "r2mail2",
"version": "0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.5.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.024"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "7.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "38.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "32.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "23.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.23"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.22"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.21"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.1"
},
{
"model": "outlook",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20100"
},
{
"model": "outlook",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20070"
},
{
"model": "kmail",
"scope": null,
"trust": 0.3,
"vendor": "kde",
"version": null
},
{
"model": "lotus inotes",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "gmail for ios",
"scope": "eq",
"trust": 0.3,
"vendor": "google",
"version": "0"
},
{
"model": "mailmate",
"scope": "eq",
"trust": 0.3,
"vendor": "freron",
"version": "0"
},
{
"model": "mail",
"scope": null,
"trust": 0.3,
"vendor": "apple",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 0.3,
"vendor": "airmail",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "BID",
"id": "104165"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gnome:evolution:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ibm:notes:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:9folders:nine:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kde:kmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ritlabs:the_bat:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2013:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2010:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:google:gmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:kde:trojita:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Damian Poddebniak, Christian Dresen, Jens Muller, Fabian Ising, Sebastian Schinzel1, Simon Friedberger, Juraj Somorovsky, and Jorg Schwenk",
"sources": [
{
"db": "BID",
"id": "104165"
}
],
"trust": 0.3
},
"cve": "CVE-2017-17689",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-108736",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-17689",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-17689",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201712-724",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-108736",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-17689",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user\u0027s e-mail client. The discoverer can attack with this vulnerability \"CBC/CFB gadget attack\" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * *CVE-2017-17688: OpenPGP CFB Attacks * *CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, \u003ca href=\"https://efail.de/efail-attack-paper.pdf\" target=\"blank\"\u003e Articles provided by the discoverer \u003c/a\u003e Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4244-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJuly 13, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : thunderbird\nCVE ID : CVE-2017-17689 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 \n CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 \n CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374\n\nMultiple security issues have been found in Thunderbird, which may lead\nto the execution of arbitrary code, denial of service or attacks on\nencrypted emails. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:52.9.1-1~deb9u1. \n\nWe recommend that you upgrade your thunderbird packages. \n\nFor the detailed security status of thunderbird please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/thunderbird\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltI+2sACgkQEMKTtsN8\nTjZXHRAAgOmSvTwwmmzxRH/4tSSpndZCFCtkHrG5PU5D3XesLGnWpNZk9aINsaU2\nih3fmEKzQgHHfAzK3d9TcGjyiI+PoVuWkVknsVqTrHd+xQtxUs7B/5Pfz5WKiYDJ\nQJ4NhjTgHHystYa0j2CvK28/ZoPVZgwnc/D051ChTInPWXimJI+TxpsndW/NPuaJ\nSphoPP34OMO2EARjrKCxiL6NRv6kD4CJv0AgoYfdO0qPXomuA8HpDAH1itd7GbRq\nyVJoZRnpz9dGjJSM5wyFCc1BIqmA/CMphhmqiRTuFBA+rOSEDblzfc2tg9t82CVQ\ncaA7rF3VrYx8qmgpP3akCju+SDOEWLerFGHH1iaQ+GBqiXvduvMl/MSXCZmVZzIC\n92Ko2m9kURkak4yKccEbHJ5Vh8i0oLUOc+Ee3MUUfWUblYbCcB4z34p9hRwc8u83\nmmGUbsq+qWvdcd9NkekKC/ENQZt4Egb3doeEzqSkaa4uhFaQ1gGosHXGslNTCqLl\n6RyeFON9Q5CWphQET+rmnlcJ8B1cSHgpG1ZTN6szlsQpiVgcRu/JYrgyzX9Y6WdY\nrAape6t+gsEeLOP7n9pZ/KYSadUF5CvYY/nX9H6kJO1RmG9y0A+8wAEuW+nSOMMJ\nvh2U09+y5XJHQqV0MMTKbnadxlyi8Oerc0zrYaoBuYhR7wmvkus=\n=R2OH\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17689"
},
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "BID",
"id": "104165"
},
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"db": "PACKETSTORM",
"id": "148553"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-17689",
"trust": 3.0
},
{
"db": "BID",
"id": "104165",
"trust": 2.1
},
{
"db": "CERT/CC",
"id": "VU#122919",
"trust": 2.0
},
{
"db": "JVN",
"id": "JVNVU95575473",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "148553",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-108736",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-17689",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"db": "BID",
"id": "104165"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "PACKETSTORM",
"id": "148553"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"id": "VAR-201805-0228",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-108736"
}
],
"trust": 0.01
},
"last_update_date": "2024-02-13T20:51:14.099000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Red Hat: CVE-2017-17689",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-17689"
},
{
"title": "Efail-malleability-gadget-exploit",
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit "
},
{
"title": "SecDB - Security Feeds",
"trust": 0.1,
"url": "https://github.com/giterlizzi/secdb-feeds "
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2018/05/14/smime_pgp_encryption_flaw_emails_vulnerable_to_snooping/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-17689"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-310",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://efail.de/"
},
{
"trust": 1.9,
"url": "https://efail.de/efail-attack-paper.pdf"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/104165"
},
{
"trust": 1.8,
"url": "https://www.synology.com/support/security/synology_sa_18_22"
},
{
"trust": 1.8,
"url": "https://efail.de"
},
{
"trust": 1.8,
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"trust": 1.8,
"url": "https://pastebin.com/gncc8aym"
},
{
"trust": 1.8,
"url": "https://twitter.com/matthew_d_green/status/996371541591019520"
},
{
"trust": 1.2,
"url": "https://www.kb.cert.org/vuls/id/122919"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://tools.ietf.org/html/rfc4880"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17688"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu95575473/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17688"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1577909"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-17689"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12362"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12360"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12363"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12365"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12373"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-5188"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12366"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12372"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12374"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12364"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12359"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/thunderbird"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"db": "BID",
"id": "104165"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "PACKETSTORM",
"id": "148553"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108736"
},
{
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"db": "BID",
"id": "104165"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "PACKETSTORM",
"id": "148553"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-14T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULHUB",
"id": "VHN-108736"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"date": "2018-05-14T00:00:00",
"db": "BID",
"id": "104165"
},
{
"date": "2018-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2018-07-14T12:12:00",
"db": "PACKETSTORM",
"id": "148553"
},
{
"date": "2017-12-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"date": "2018-05-16T19:29:00.303000",
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-15T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-108736"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17689"
},
{
"date": "2018-05-14T00:00:00",
"db": "BID",
"id": "104165"
},
{
"date": "2018-08-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-724"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2017-17689"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OpenPGP and S/MIME mail client vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-724"
}
],
"trust": 0.6
}
}
FKIE_CVE-2012-6640
Vulnerability from fkie_nvd - Published: 2014-04-05 21:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://lists.horde.org/archives/announce/2012/000775.html | ||
| cve@mitre.org | http://lists.horde.org/archives/announce/2012/000840.html | ||
| cve@mitre.org | https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2012/000775.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2012/000840.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | groupware | * | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0.1 | |
| horde | groupware | 4.0.2 | |
| horde | groupware | 4.0.3 | |
| horde | groupware | 4.0.4 | |
| horde | groupware | 4.0.5 | |
| horde | groupware | 4.0.6 | |
| horde | groupware | 4.0.7 | |
| horde | imp | * | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0.1 | |
| horde | imp | 5.0.2 | |
| horde | imp | 5.0.3 | |
| horde | imp | 5.0.4 | |
| horde | imp | 5.0.5 | |
| horde | imp | 5.0.6 | |
| horde | imp | 5.0.7 | |
| horde | imp | 5.0.8 | |
| horde | imp | 5.0.9 | |
| horde | imp | 5.0.10 | |
| horde | imp | 5.0.11 | |
| horde | imp | 5.0.12 | |
| horde | imp | 5.0.13 | |
| horde | imp | 5.0.14 | |
| horde | imp | 5.0.15 | |
| horde | imp | 5.0.16 | |
| horde | imp | 5.0.17 | |
| horde | imp | 5.0.18 | |
| horde | imp | 5.0.19 | |
| horde | imp | 5.0.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:groupware:*:*:webamail:*:*:*:*:*",
"matchCriteriaId": "E888C8C2-27C5-4BD0-9EEE-750DF5DE6488",
"versionEndIncluding": "4.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:*:webamail:*:*:*:*:*",
"matchCriteriaId": "F505E80A-B91C-401C-9B77-F34B00ECA434",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:rc1:webamail:*:*:*:*:*",
"matchCriteriaId": "A9129D4A-F365-4630-976A-DBFBBEA531FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:rc2:webamail:*:*:*:*:*",
"matchCriteriaId": "C910D464-66B3-4593-A7D8-3FD3EADB9AFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*",
"matchCriteriaId": "A6A67FDD-C9CE-43E4-ADD9-DB5699BEF61C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.2:*:webamail:*:*:*:*:*",
"matchCriteriaId": "A1158FCA-2AAB-4EC4-9B34-F1B44DDA4FA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.3:*:webamail:*:*:*:*:*",
"matchCriteriaId": "2A0A5DB9-3731-466D-8D0F-7BE71A34184B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.4:*:webamail:*:*:*:*:*",
"matchCriteriaId": "5D07339E-54B9-4513-82EB-0FB53AD5B82B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.5:*:webamail:*:*:*:*:*",
"matchCriteriaId": "717CB664-818F-4583-83FF-47B167993569",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.6:*:webamail:*:*:*:*:*",
"matchCriteriaId": "185839EF-1F07-4C2C-B710-FD607EAD0A71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.7:*:webamail:*:*:*:*:*",
"matchCriteriaId": "29D96163-C022-4DBD-8B94-746665B99A73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2C4F200B-F579-4B46-BECB-284FA36393F4",
"versionEndIncluding": "5.0.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD07BF20-09CE-4D32-A935-8EAA8363356F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "1B91647A-F174-4F2E-992E-BDA23B2E3545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "126DFFE7-AD9F-41E8-8AA0-C0F9CE80271A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B02F8BA6-4A13-48CA-BAC9-F8C932453EF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "20AA91CC-4B6C-4BC9-9730-C613300702AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EE8E0715-9A6B-4A7C-9A6F-4B7A344B0968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "382D599B-09EC-4C2A-8F23-EB5D03C4AA5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "15348E42-1A70-4787-95B0-9EDB100BB36C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "353AD017-60F5-4168-B672-17EF90CDCB64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBB960F-026D-4C40-BC61-0D963C9E25E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B0D3990B-339B-498A-A5B5-780DA8A0ABD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CAF27F1F-F405-47F8-9486-E86555D61B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8B2E22CB-E82E-4203-B9E9-4BDA58C9A5EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE4D6BE-11F3-468E-8CB2-44AA1B3BA7FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "74EE40AB-753A-4109-AE27-7BDD78B047A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5A03CD8B-C101-4737-B435-B43D543E6335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3C95A9-E61E-45BF-9FBD-EBE16F4B3189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "94B7724A-D3D2-4511-9E44-E0C71E049854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "40F93E89-8B6D-4A1F-BBD9-B154B5489236",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "BF189F04-60A6-4D80-BCCD-B405F35AAE1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FA984AF6-BE4F-4F23-9D42-3B05B05F6FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "7B27528A-1090-4834-808C-39202BFB2A18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "09A43FBB-5345-4D86-B5A2-885DEDDEF70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "981F83E1-6D69-401D-9F11-9A8A2036BF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "823C5DDE-2853-472C-9367-2E7E1E97D61C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en Horde Internet Mail Program (IMP) anterior a 5.0.22, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s de un adjunto de imagen SVG manipulado, una vulnerabilidad diferente a CVE-2012-5565."
}
],
"id": "CVE-2012-6640",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-04-05T21:55:06.330",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2012/000775.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-5565
Vulnerability from fkie_nvd - Published: 2014-04-05 21:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | http://lists.horde.org/archives/announce/2012/000833.html | ||
| secalert@redhat.com | http://lists.horde.org/archives/announce/2012/000840.html | Vendor Advisory | |
| secalert@redhat.com | http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html | ||
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2012/11/23/6 | ||
| secalert@redhat.com | https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2012/000833.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2012/000840.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2012/11/23/6 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | imp | * | |
| horde | imp | 5.0.4 | |
| horde | imp | 5.0.5 | |
| horde | imp | 5.0.6 | |
| horde | imp | 5.0.7 | |
| horde | imp | 5.0.8 | |
| horde | imp | 5.0.9 | |
| horde | imp | 5.0.10 | |
| horde | imp | 5.0.11 | |
| horde | imp | 5.0.12 | |
| horde | imp | 5.0.13 | |
| horde | imp | 5.0.14 | |
| horde | imp | 5.0.15 | |
| horde | imp | 5.0.16 | |
| horde | imp | 5.0.17 | |
| horde | imp | 5.0.18 | |
| horde | imp | 5.0.19 | |
| horde | imp | 5.0.20 | |
| horde | imp | 5.0.21 | |
| horde | imp | 5.0.22 | |
| horde | groupware | * | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0 | |
| horde | groupware | 4.0.1 | |
| horde | groupware | 4.0.2 | |
| horde | groupware | 4.0.3 | |
| horde | groupware | 4.0.4 | |
| horde | groupware | 4.0.5 | |
| horde | groupware | 4.0.6 | |
| horde | groupware | 4.0.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E28CB330-C845-4E68-989E-807B16726CC7",
"versionEndIncluding": "5.0.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "353AD017-60F5-4168-B672-17EF90CDCB64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBB960F-026D-4C40-BC61-0D963C9E25E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B0D3990B-339B-498A-A5B5-780DA8A0ABD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CAF27F1F-F405-47F8-9486-E86555D61B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8B2E22CB-E82E-4203-B9E9-4BDA58C9A5EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE4D6BE-11F3-468E-8CB2-44AA1B3BA7FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "74EE40AB-753A-4109-AE27-7BDD78B047A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5A03CD8B-C101-4737-B435-B43D543E6335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3C95A9-E61E-45BF-9FBD-EBE16F4B3189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "94B7724A-D3D2-4511-9E44-E0C71E049854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "40F93E89-8B6D-4A1F-BBD9-B154B5489236",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "BF189F04-60A6-4D80-BCCD-B405F35AAE1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FA984AF6-BE4F-4F23-9D42-3B05B05F6FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "7B27528A-1090-4834-808C-39202BFB2A18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "09A43FBB-5345-4D86-B5A2-885DEDDEF70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "981F83E1-6D69-401D-9F11-9A8A2036BF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "823C5DDE-2853-472C-9367-2E7E1E97D61C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "1E513887-24D1-4F94-9948-F355F9778CF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.22:*:*:*:*:*:*:*",
"matchCriteriaId": "58D4656C-5230-4155-9435-FFFB6E9F515F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:groupware:*:*:webamail:*:*:*:*:*",
"matchCriteriaId": "E888C8C2-27C5-4BD0-9EEE-750DF5DE6488",
"versionEndIncluding": "4.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:*:webamail:*:*:*:*:*",
"matchCriteriaId": "F505E80A-B91C-401C-9B77-F34B00ECA434",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:rc1:webamail:*:*:*:*:*",
"matchCriteriaId": "A9129D4A-F365-4630-976A-DBFBBEA531FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0:rc2:webamail:*:*:*:*:*",
"matchCriteriaId": "C910D464-66B3-4593-A7D8-3FD3EADB9AFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*",
"matchCriteriaId": "A6A67FDD-C9CE-43E4-ADD9-DB5699BEF61C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.2:*:webamail:*:*:*:*:*",
"matchCriteriaId": "A1158FCA-2AAB-4EC4-9B34-F1B44DDA4FA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.3:*:webamail:*:*:*:*:*",
"matchCriteriaId": "2A0A5DB9-3731-466D-8D0F-7BE71A34184B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.4:*:webamail:*:*:*:*:*",
"matchCriteriaId": "5D07339E-54B9-4513-82EB-0FB53AD5B82B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.5:*:webamail:*:*:*:*:*",
"matchCriteriaId": "717CB664-818F-4583-83FF-47B167993569",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.6:*:webamail:*:*:*:*:*",
"matchCriteriaId": "185839EF-1F07-4C2C-B710-FD607EAD0A71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:4.0.7:*:webamail:*:*:*:*:*",
"matchCriteriaId": "29D96163-C022-4DBD-8B94-746665B99A73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en js/compose-dimp.js en Horde Internet Mail Program (IMP) anterior a 5.0.24, utilizado en Horde Groupware Webmail Edition anterior a 4.0.9, permite a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s de un nombre manipulado para un archivo adjunto, relacionado con la visualizaci\u00f3n din\u00e1mica."
}
],
"id": "CVE-2012-5565",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-04-05T21:55:06.190",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2012/000833.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2012/000840.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/11/23/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-0791
Vulnerability from fkie_nvd - Published: 2012-01-24 18:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | http://secunia.com/advisories/47580 | Vendor Advisory | |
| secalert@redhat.com | http://secunia.com/advisories/47592 | Vendor Advisory | |
| secalert@redhat.com | http://www.debian.org/security/2012/dsa-2485 | ||
| secalert@redhat.com | http://www.horde.org/apps/imp/docs/CHANGES | ||
| secalert@redhat.com | http://www.horde.org/apps/imp/docs/RELEASE_NOTES | ||
| secalert@redhat.com | http://www.horde.org/apps/webmail/docs/CHANGES | ||
| secalert@redhat.com | http://www.horde.org/apps/webmail/docs/RELEASE_NOTES | ||
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2012/01/22/2 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/51586 | ||
| secalert@redhat.com | http://www.securitytracker.com/id?1026553 | ||
| secalert@redhat.com | http://www.securitytracker.com/id?1026554 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/47580 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/47592 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2485 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.horde.org/apps/imp/docs/CHANGES | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.horde.org/apps/imp/docs/RELEASE_NOTES | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.horde.org/apps/webmail/docs/CHANGES | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.horde.org/apps/webmail/docs/RELEASE_NOTES | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2012/01/22/2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/51586 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1026553 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1026554 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | dynamic_imp | * | |
| horde | dynamic_imp | 1.0 | |
| horde | dynamic_imp | 1.0 | |
| horde | dynamic_imp | 1.0 | |
| horde | dynamic_imp | 1.0 | |
| horde | dynamic_imp | 1.0 | |
| horde | dynamic_imp | 1.1 | |
| horde | dynamic_imp | 1.1 | |
| horde | dynamic_imp | 1.1 | |
| horde | dynamic_imp | 1.1.1 | |
| horde | dynamic_imp | 1.1.2 | |
| horde | dynamic_imp | 1.1.3 | |
| horde | dynamic_imp | 1.1.4 | |
| horde | dynamic_imp | 1.1.5 | |
| horde | dynamic_imp | 1.1.6 | |
| horde | dynamic_imp | 5.0 | |
| horde | dynamic_imp | 5.0.1 | |
| horde | dynamic_imp | 5.0.2 | |
| horde | dynamic_imp | 5.0.3 | |
| horde | dynamic_imp | 5.0.4 | |
| horde | dynamic_imp | 5.0.5 | |
| horde | dynamic_imp | 5.0.6 | |
| horde | dynamic_imp | 5.0.7 | |
| horde | dynamic_imp | 5.0.8 | |
| horde | dynamic_imp | 5.0.9 | |
| horde | dynamic_imp | 5.0.10 | |
| horde | dynamic_imp | 5.0.11 | |
| horde | dynamic_imp | 5.0.12 | |
| horde | dynamic_imp | 5.0.13 | |
| horde | dynamic_imp | 5.0.14 | |
| horde | dynamic_imp | 5.0.15 | |
| horde | dynamic_imp | 5.0.16 | |
| horde | imp | 2.0 | |
| horde | imp | 2.2 | |
| horde | imp | 2.2.1 | |
| horde | imp | 2.2.2 | |
| horde | imp | 2.2.3 | |
| horde | imp | 2.2.4 | |
| horde | imp | 2.2.5 | |
| horde | imp | 2.2.6 | |
| horde | imp | 2.2.7 | |
| horde | imp | 2.2.8 | |
| horde | imp | 2.3 | |
| horde | imp | 3.0 | |
| horde | imp | 3.1 | |
| horde | imp | 3.1.2 | |
| horde | imp | 3.2 | |
| horde | imp | 3.2.1 | |
| horde | imp | 3.2.2 | |
| horde | imp | 3.2.3 | |
| horde | imp | 3.2.4 | |
| horde | imp | 3.2.5 | |
| horde | imp | 3.2.6 | |
| horde | imp | 3.2.7 | |
| horde | imp | 3.2.7 | |
| horde | imp | 4.0 | |
| horde | imp | 4.0.1 | |
| horde | imp | 4.0.2 | |
| horde | imp | 4.0.3 | |
| horde | imp | 4.0.4 | |
| horde | imp | 4.1.3 | |
| horde | imp | 4.1.5 | |
| horde | imp | 4.1.6 | |
| horde | imp | 4.2 | |
| horde | imp | 4.2.1 | |
| horde | imp | 4.2.2 | |
| horde | imp | 4.3 | |
| horde | imp | 4.3.1 | |
| horde | imp | 4.3.2 | |
| horde | imp | 4.3.3 | |
| horde | imp | 4.3.4 | |
| horde | imp | 4.3.5 | |
| horde | imp | 4.3.6 | |
| horde | imp | 4.3.7 | |
| horde | imp | 4.3.8 | |
| horde | imp | 4.3.9 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0 | |
| horde | imp | 5.0.1 | |
| horde | imp | 5.0.2 | |
| horde | imp | 5.0.3 | |
| horde | imp | 5.0.4-git | |
| horde | groupware_webmail_edition | * | |
| horde | groupware_webmail_edition | 1.0 | |
| horde | groupware_webmail_edition | 1.0 | |
| horde | groupware_webmail_edition | 1.0 | |
| horde | groupware_webmail_edition | 1.0.1 | |
| horde | groupware_webmail_edition | 1.0.2 | |
| horde | groupware_webmail_edition | 1.0.3 | |
| horde | groupware_webmail_edition | 1.0.4 | |
| horde | groupware_webmail_edition | 1.0.5 | |
| horde | groupware_webmail_edition | 1.0.6 | |
| horde | groupware_webmail_edition | 1.0.7 | |
| horde | groupware_webmail_edition | 1.0.8 | |
| horde | groupware_webmail_edition | 1.1 | |
| horde | groupware_webmail_edition | 1.1 | |
| horde | groupware_webmail_edition | 1.1 | |
| horde | groupware_webmail_edition | 1.1 | |
| horde | groupware_webmail_edition | 1.1 | |
| horde | groupware_webmail_edition | 1.1.1 | |
| horde | groupware_webmail_edition | 1.1.2 | |
| horde | groupware_webmail_edition | 1.1.3 | |
| horde | groupware_webmail_edition | 1.1.4 | |
| horde | groupware_webmail_edition | 1.1.5 | |
| horde | groupware_webmail_edition | 1.1.6 | |
| horde | groupware_webmail_edition | 1.2 | |
| horde | groupware_webmail_edition | 1.2 | |
| horde | groupware_webmail_edition | 1.2.1 | |
| horde | groupware_webmail_edition | 1.2.2 | |
| horde | groupware_webmail_edition | 1.2.3 | |
| horde | groupware_webmail_edition | 1.2.3 | |
| horde | groupware_webmail_edition | 1.2.4 | |
| horde | groupware_webmail_edition | 1.2.5 | |
| horde | groupware_webmail_edition | 1.2.6 | |
| horde | groupware_webmail_edition | 1.2.7 | |
| horde | groupware_webmail_edition | 1.2.8 | |
| horde | groupware_webmail_edition | 1.2.9 | |
| horde | groupware_webmail_edition | 1.2.10 | |
| horde | groupware_webmail_edition | 4.0 | |
| horde | groupware_webmail_edition | 4.0 | |
| horde | groupware_webmail_edition | 4.0 | |
| horde | groupware_webmail_edition | 4.0.1 | |
| horde | groupware_webmail_edition | 4.0.2 | |
| horde | groupware_webmail_edition | 4.0.3 | |
| horde | groupware_webmail_edition | 4.0.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7395F88E-27B2-4C93-8360-3A925DBC7ED4",
"versionEndIncluding": "5.0.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AC88E67E-01FD-4B3A-A186-C0D5A8F3111D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "CBC6D9CA-DDD0-4D79-845B-95AEF907BC8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72796BEA-2929-4730-BD97-52686ACA0A34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "D01633AC-7627-4DDA-A2FA-942D2F962567",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "6B517AA9-55B2-48E5-A1C0-83AAA1A38435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "349FE027-660E-42A8-9382-1049F827AE3B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "718B8347-55A5-4909-87DD-071F9D4606A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "741ECFFC-A7A5-4BF2-B9E4-C5E06F3AF0DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "155EE1D9-0EA9-4EFC-953D-5BD24FA596CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0CA83502-F507-4914-96A2-CFB7FDF29568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "939C5E5C-BA4D-4F65-BA9C-EEE70D18016C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0738E854-CAB5-4480-AD07-20EC35466640",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "AA96BD59-233E-43C3-BE19-673CD6622EBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A91FBA6A-AC38-4879-9084-88753B4D911B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AFEE15-D89D-4C0F-BFD6-9ECF3163B7A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C53AD47-FE94-403B-BCCC-1357FD2C6622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DF1DB223-163D-46B9-B8EF-33CF8A49EA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "52BC3866-0E7F-46E8-9347-C7B4BD1C0B02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E8031AE6-A3F9-4BBD-BAC9-1C224D6AB567",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7DB366EE-49A1-4395-BAA0-69BEA76CEACC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4181ACC9-B59D-4ADF-B433-F0DC9227B33A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "F372DA3C-39AC-4589-A23C-FFB62F919531",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E4C10EED-D008-4695-84D5-6D0DFA4147B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C924A1E2-5EC7-4F6A-94A3-F8C17FF3A4D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "494DFA09-3750-4A40-960D-7973761BCB1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "567AC297-F328-43AA-BB3A-776BE6BE0337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "193EED6E-67FE-44CB-9A77-C28D1C376357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "2D312F2C-8F5D-47F8-94BE-7E1992C41DB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "54E7B338-3153-4B34-B880-3E3B80B4B185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "991CAA1F-E3BA-48AC-A1FD-DACC2D204D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:dynamic_imp:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8E2E0B7B-64DA-47CE-90B4-F468F2C67E26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D2A8C5B-6155-4B40-B8C8-B4944064E3DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D11E08A4-79D6-46FE-880F-66E9778C298E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3894F-2E3F-49CA-BEE5-759D603F6EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDBDC41-7E6F-4C97-95BD-7DEB2D9FE837",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3B52D447-8E56-4E04-9650-38D222DA8D2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1C455353-0401-4975-89BC-C23D32A684F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D9D9E1-D8B7-4A56-BC2F-90BDC97322B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "59DE856E-98FF-4B49-BD7F-3E326FEB89EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6ED34889-9F98-46BC-9176-557484272C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B7FBC61D-6A08-4DE8-A5E5-A3FC57E7759D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E52AEEE6-2364-4CFB-9337-C5CCA54362E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD137160-B80D-4C65-A9A9-CEE12107E3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6C2AC8-C21A-4152-AAE6-915ACE65CB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1956C8F0-EB91-4322-85C1-6BE15AA13703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DEBEB-0C2D-4F6A-AF63-04990D2FD5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E004FA4-0180-458A-8E8C-8167EF684ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F0A1617-17D1-4C9F-A818-27321FD2FEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CDC19-43C3-4ACC-94B4-388BCC8A2203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9931A5B-CD0C-43A3-B32D-915FF4AF57D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDC69F98-A3B4-4573-AFE4-2069218B3454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4D0137-3515-4857-8E70-4600CD2D4278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A59756D1-3401-4B15-8B68-AA68B5BC3223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "73FD31BC-651B-461F-B9F4-6CA8D5CCE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "184592A5-4108-40DB-8882-9D2468490DE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "28470602-E3F1-4F04-B012-F91AB95E7A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B584932-BFB2-4462-BC69-B9FCC059F59F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "702F7A33-CF9E-4966-B622-E4BD27B120AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FF1BB456-5462-4ACE-AECF-730B1C7BE2CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1D23A341-217D-4AF2-AC61-DFC9761AFE3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C129AAEE-5388-4D81-AC1F-570EFF27EF89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "01CBF0CE-7133-4281-842C-3584AE13F36D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "373263B9-D967-4A9B-A062-FC841061E143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05FAFC4C-8E72-4EA5-930F-6F76CCD0138A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F91A26C3-D538-4935-90FF-DDD5E8733968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1F9064E7-6081-4B23-BC03-21E6F483FA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E60BFE2-B3E4-416F-9697-58D912907E86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C5D659-E2C1-444D-8B5C-28970D830F1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "72D702C7-2789-4837-BC74-59570B13B4C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1A363643-3EF2-4F05-A934-0187AF846D51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4611791C-DA55-4F37-9030-1BEA17D0D817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2C5EC486-EF14-43DF-9152-69456E0FE271",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "82EC0D61-EC7E-4BF3-9217-C1387ADB5794",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB4B2C3E-9BB5-4403-9A7C-5AD0B92F02E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "31213DF1-47CC-4DCD-B8A5-5F0D30956859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD07BF20-09CE-4D32-A935-8EAA8363356F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "1B91647A-F174-4F2E-992E-BDA23B2E3545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "126DFFE7-AD9F-41E8-8AA0-C0F9CE80271A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B02F8BA6-4A13-48CA-BAC9-F8C932453EF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "20AA91CC-4B6C-4BC9-9730-C613300702AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EE8E0715-9A6B-4A7C-9A6F-4B7A344B0968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "382D599B-09EC-4C2A-8F23-EB5D03C4AA5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "15348E42-1A70-4787-95B0-9EDB100BB36C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:5.0.4-git:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE40F36-6872-4C47-9A1E-F4EEEA115696",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0BA941-3235-46CB-A368-7E17482B0A15",
"versionEndIncluding": "4.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1A30F59C-D09A-495D-B5E5-E908D913164E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "48205A35-1F67-4E90-A891-29AA4D2CC138",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "276A0BB9-6808-4901-8EEB-766AF6EE4E3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6E367E84-DD66-4512-BCDE-7D7E62B72A13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B013D26B-BE67-4131-B320-EF87D19E9C67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "664B0D12-607C-4B5F-AC8E-FB1BBD1332E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "989D5040-13B3-4D76-A516-81CAB112FE44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA0765C9-BBFB-4676-9D79-0CFD86BCF9E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "842159D1-E30C-4077-8E92-07979E52C10B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81D9B15F-C3CA-44DF-BF5E-51741793348B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "359D7ED8-E171-4822-B2F3-80E07287A787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "46ADF628-449A-463E-A459-69FD9DB2ADAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5E8F448D-DFB5-4BA3-BD28-13E39FF82A9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "5C783DC9-4379-49A8-A026-D1F933DB36AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "2AD6F3C8-50F8-4E9B-98EA-8962B2310780",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "36CFEF77-BE64-4547-9A5F-DABD589C5ED0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0C7522F6-DF2C-4225-932F-2D27C1EFD792",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "53BE7A07-3455-4A18-BDBC-DC261B35D427",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "503BB3EF-2BDC-4019-8EE2-B121A2600DB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54DA4725-AAA4-4A4B-B6A4-9A139A6176AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA22094F-3A01-4B66-99E1-0ED9D5574F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0D105C44-38EE-4D86-9334-DA0E8A08B725",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C145E10-4AC0-4F25-9D98-64447BB7C103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "461A597A-93DD-4A12-BB04-C02277317C66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B256AACA-93C8-447A-AB08-ABF0A9E4E63D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9D634210-6D2D-4181-8310-73FB5B9872D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4C10C8DB-FB73-4982-8B92-D3E1FB1C59A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "319BC54E-2A0B-4033-AD73-3E8825E8D9B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6A86680C-839E-4EED-9B32-CE101DC7B6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DF0F1DCA-7D9F-42E3-9FB9-D3C100F09A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5BFADDD4-8B5E-4EE7-A390-CDFD48CE3ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F5FB253-C2E5-48F3-B13F-79C45024D89D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E7D0D17F-B2E4-496D-9ACD-170C33B453F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6314FAC0-544A-492F-81BA-9169EB69E74D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "70CC6175-10F8-4DD9-A1E7-202F5F4A221C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3ED61953-A384-498C-AFFD-F83ADF51CFD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EC13F5CD-2BB9-4FA7-BE4C-D2175E18E063",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FFF8191E-F2EA-4071-B26D-8E45103D4A0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "040AC7A5-689B-4F12-A199-FB395E4CB84B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2CFD1571-C070-4B5F-9BA3-5B1789068396",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0909400D-75C6-4DED-8C77-333D8F092AA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "08050D4C-6620-4177-9967-044AD2B9368B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerbilidades de ejecuci\u00f3n de secuencias de comandos web en sitios cruzados (XSS) en Horde IMP anterior a v5.0.18 y Horde Groupware Webmail Edition anterior a v4.0.6 permite a atacantes remotos inyectar c\u00f3digo HTML o script web a trav\u00e9s de los par\u00e1metros que componen la p\u00e1gina (1) composeCache, (2) rtemode, o (3) filename_*;(4) par\u00e1metro formname para ventanas popup; o (5) nombres de buz\u00f3n IMAP. NOTA: Algunos de estos detalles han sido obtenidos de terceras partes de informaci\u00f3n."
}
],
"id": "CVE-2012-0791",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-01-24T18:55:01.440",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47580"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47592"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"source": "secalert@redhat.com",
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"source": "secalert@redhat.com",
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"source": "secalert@redhat.com",
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"source": "secalert@redhat.com",
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/51586"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id?1026553"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securitytracker.com/id?1026554"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47580"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2485"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.horde.org/apps/imp/docs/CHANGES"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.horde.org/apps/imp/docs/RELEASE_NOTES"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.horde.org/apps/webmail/docs/CHANGES"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.horde.org/apps/webmail/docs/RELEASE_NOTES"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/01/22/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/51586"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1026553"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1026554"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-4778
Vulnerability from fkie_nvd - Published: 2011-04-04 12:27 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11 | Patch | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2010/2513 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2010/2513 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | imp | * | |
| horde | imp | 2.0 | |
| horde | imp | 2.2 | |
| horde | imp | 2.2.1 | |
| horde | imp | 2.2.2 | |
| horde | imp | 2.2.3 | |
| horde | imp | 2.2.4 | |
| horde | imp | 2.2.5 | |
| horde | imp | 2.2.6 | |
| horde | imp | 2.2.7 | |
| horde | imp | 2.2.8 | |
| horde | imp | 2.3 | |
| horde | imp | 3.0 | |
| horde | imp | 3.1 | |
| horde | imp | 3.1.2 | |
| horde | imp | 3.2 | |
| horde | imp | 3.2.1 | |
| horde | imp | 3.2.2 | |
| horde | imp | 3.2.3 | |
| horde | imp | 3.2.4 | |
| horde | imp | 3.2.5 | |
| horde | imp | 3.2.6 | |
| horde | imp | 3.2.7 | |
| horde | imp | 3.2.7 | |
| horde | imp | 4.0 | |
| horde | imp | 4.0.1 | |
| horde | imp | 4.0.2 | |
| horde | imp | 4.0.3 | |
| horde | imp | 4.0.4 | |
| horde | imp | 4.1.3 | |
| horde | imp | 4.1.5 | |
| horde | imp | 4.1.6 | |
| horde | imp | 4.2 | |
| horde | imp | 4.2.1 | |
| horde | imp | 4.2.2 | |
| horde | imp | 4.3 | |
| horde | imp | 4.3.1 | |
| horde | imp | 4.3.2 | |
| horde | imp | 4.3.3 | |
| horde | imp | 4.3.4 | |
| horde | imp | 4.3.5 | |
| horde | imp | 4.3.6 | |
| horde | groupware | * | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0.1 | |
| horde | groupware | 1.0.2 | |
| horde | groupware | 1.0.3 | |
| horde | groupware | 1.0.4 | |
| horde | groupware | 1.0.5 | |
| horde | groupware | 1.0.6 | |
| horde | groupware | 1.0.7 | |
| horde | groupware | 1.0.8 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1.1 | |
| horde | groupware | 1.1.2 | |
| horde | groupware | 1.1.3 | |
| horde | groupware | 1.1.4 | |
| horde | groupware | 1.1.5 | |
| horde | groupware | 1.1.6 | |
| horde | groupware | 1.2 | |
| horde | groupware | 1.2 | |
| horde | groupware | 1.2.1 | |
| horde | groupware | 1.2.2 | |
| horde | groupware | 1.2.3 | |
| horde | groupware | 1.2.3 | |
| horde | groupware | 1.2.4 | |
| horde | groupware | 1.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "313CF637-CA8F-4AC0-BE3D-9D7B4125D81E",
"versionEndIncluding": "4.3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D2A8C5B-6155-4B40-B8C8-B4944064E3DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D11E08A4-79D6-46FE-880F-66E9778C298E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3894F-2E3F-49CA-BEE5-759D603F6EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDBDC41-7E6F-4C97-95BD-7DEB2D9FE837",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3B52D447-8E56-4E04-9650-38D222DA8D2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1C455353-0401-4975-89BC-C23D32A684F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D9D9E1-D8B7-4A56-BC2F-90BDC97322B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "59DE856E-98FF-4B49-BD7F-3E326FEB89EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6ED34889-9F98-46BC-9176-557484272C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B7FBC61D-6A08-4DE8-A5E5-A3FC57E7759D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E52AEEE6-2364-4CFB-9337-C5CCA54362E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD137160-B80D-4C65-A9A9-CEE12107E3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6C2AC8-C21A-4152-AAE6-915ACE65CB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1956C8F0-EB91-4322-85C1-6BE15AA13703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DEBEB-0C2D-4F6A-AF63-04990D2FD5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E004FA4-0180-458A-8E8C-8167EF684ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F0A1617-17D1-4C9F-A818-27321FD2FEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CDC19-43C3-4ACC-94B4-388BCC8A2203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9931A5B-CD0C-43A3-B32D-915FF4AF57D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDC69F98-A3B4-4573-AFE4-2069218B3454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4D0137-3515-4857-8E70-4600CD2D4278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A59756D1-3401-4B15-8B68-AA68B5BC3223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "73FD31BC-651B-461F-B9F4-6CA8D5CCE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "184592A5-4108-40DB-8882-9D2468490DE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "28470602-E3F1-4F04-B012-F91AB95E7A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B584932-BFB2-4462-BC69-B9FCC059F59F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "702F7A33-CF9E-4966-B622-E4BD27B120AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FF1BB456-5462-4ACE-AECF-730B1C7BE2CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1D23A341-217D-4AF2-AC61-DFC9761AFE3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C129AAEE-5388-4D81-AC1F-570EFF27EF89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "01CBF0CE-7133-4281-842C-3584AE13F36D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "373263B9-D967-4A9B-A062-FC841061E143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05FAFC4C-8E72-4EA5-930F-6F76CCD0138A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F91A26C3-D538-4935-90FF-DDD5E8733968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1F9064E7-6081-4B23-BC03-21E6F483FA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E60BFE2-B3E4-416F-9697-58D912907E86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C5D659-E2C1-444D-8B5C-28970D830F1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "72D702C7-2789-4837-BC74-59570B13B4C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1A363643-3EF2-4F05-A934-0187AF846D51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4611791C-DA55-4F37-9030-1BEA17D0D817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2C5EC486-EF14-43DF-9152-69456E0FE271",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D82E23DB-0652-4BA9-9D9A-0107BEC1EA31",
"versionEndIncluding": "1.2.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "71C2653B-7F0B-4628-9E77-44744BC05463",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E55009DF-EDF1-4FAE-88E7-1CF33BFFEBC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "980162BB-48B3-4921-987A-6D18C62965A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DC241F01-B9DF-4D0E-BA3C-3523AEEB6BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B574D428-0A3A-47CA-A926-5C936F83919A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D59C23FB-E223-4EED-8F69-3CC1EE7DF148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "904EEFF0-CF66-43E6-BAA9-1A6FB4115CB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B3AB0176-9CB3-4D49-B644-2C413C9B6E13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C95E9B57-2DB0-4692-A7D1-180EC3687D1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6E7D8683-8DD4-4EB0-A28F-0C556304BB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "9F68E5D5-7812-4FB2-ACF9-76180B038D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C6BBB036-494E-41D4-BD04-40906FAB5C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "37B76B27-ADF0-4E88-B92C-304FB38A356E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "965F245A-879A-4DF0-ABC5-588E78C4CBBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "3DCB29F9-3875-4264-8117-5751FEDC3350",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "59FC250F-EF0B-4604-99A2-3EEB8B2DEB77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1C10E681-5D2B-4EA4-B8E1-C0CA4FC9D3FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CC5154-42C5-4877-9147-5DFD61BD5CDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "62AAEBBF-1696-4EAC-8837-68A03C2D2F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F626876D-99FC-4DE0-BEE0-35874C4E25F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A849DD3E-882A-4621-BB6C-315A76677BB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AAF1A6AE-0748-476B-ACE2-DA43A9443B7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AB711B5E-9011-4BA2-917A-DB8545705E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "50DC1068-F426-497F-A5A0-E032BC3816F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C5A176-8C72-40EA-85AC-F11B40FD53A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CB4C3487-4556-47E5-8BF3-1DEDF0E9AFEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "78F24E43-491B-4AD1-B905-66F7FC6DA98D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F577A169-8354-4218-B3C6-04DA4BDF1E3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1FAFD66F-81F7-48F9-87F0-E394F55A1288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2BA91C75-69CF-45AE-AF23-ADE9259B7C9C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en fetchmailprefs.php en Horde IMP antes de v4.3.8, y Horde Groupware Webmail Edition anterior a v1.2.7, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de los campos ( 1 ) nombre de usuario (tambi\u00e9n conocido como fmusername ), ( 2 ) contrase\u00f1a ( fmpassword alias ), o (3 ) servidor ( tambi\u00e9n conocido como fmserver ) de la acci\u00f3n fetchmail_prefs_save, relacionados con la configuraci\u00f3n de Fetchmail, una cuesti\u00f3n diferente a CVE - 2010-3695. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros.."
}
],
"id": "CVE-2010-4778",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-04-04T12:27:36.437",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-3695
Vulnerability from fkie_nvd - Published: 2011-03-31 22:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html | Exploit | |
| secalert@redhat.com | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584 | Exploit, Patch | |
| secalert@redhat.com | http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h | ||
| secalert@redhat.com | http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h | ||
| secalert@redhat.com | http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11 | Patch | |
| secalert@redhat.com | http://lists.horde.org/archives/announce/2010/000558.html | Patch | |
| secalert@redhat.com | http://lists.horde.org/archives/announce/2010/000568.html | ||
| secalert@redhat.com | http://openwall.com/lists/oss-security/2010/09/30/7 | Exploit, Patch | |
| secalert@redhat.com | http://openwall.com/lists/oss-security/2010/09/30/8 | Exploit, Patch | |
| secalert@redhat.com | http://openwall.com/lists/oss-security/2010/10/01/6 | Patch | |
| secalert@redhat.com | http://secunia.com/advisories/41627 | Vendor Advisory | |
| secalert@redhat.com | http://secunia.com/advisories/43896 | Vendor Advisory | |
| secalert@redhat.com | http://securityreason.com/securityalert/8170 | ||
| secalert@redhat.com | http://www.debian.org/security/2011/dsa-2204 | ||
| secalert@redhat.com | http://www.securityfocus.com/archive/1/513992/100/0/threaded | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/43515 | Exploit | |
| secalert@redhat.com | http://www.vupen.com/english/advisories/2010/2513 | Vendor Advisory | |
| secalert@redhat.com | http://www.vupen.com/english/advisories/2011/0769 | Vendor Advisory | |
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=641069 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html | Exploit | |
| af854a3a-2127-422b-91ae-364da2661108 | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2010/000558.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2010/000568.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2010/09/30/7 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2010/09/30/8 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2010/10/01/6 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/41627 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/43896 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://securityreason.com/securityalert/8170 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2011/dsa-2204 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/513992/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/43515 | Exploit | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2010/2513 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2011/0769 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=641069 | Exploit, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | imp | * | |
| horde | imp | 2.0 | |
| horde | imp | 2.2 | |
| horde | imp | 2.2.1 | |
| horde | imp | 2.2.2 | |
| horde | imp | 2.2.3 | |
| horde | imp | 2.2.4 | |
| horde | imp | 2.2.5 | |
| horde | imp | 2.2.6 | |
| horde | imp | 2.2.7 | |
| horde | imp | 2.2.8 | |
| horde | imp | 2.3 | |
| horde | imp | 3.0 | |
| horde | imp | 3.1 | |
| horde | imp | 3.1.2 | |
| horde | imp | 3.2 | |
| horde | imp | 3.2.1 | |
| horde | imp | 3.2.2 | |
| horde | imp | 3.2.3 | |
| horde | imp | 3.2.4 | |
| horde | imp | 3.2.5 | |
| horde | imp | 3.2.6 | |
| horde | imp | 3.2.7 | |
| horde | imp | 3.2.7 | |
| horde | imp | 4.0 | |
| horde | imp | 4.0.1 | |
| horde | imp | 4.0.2 | |
| horde | imp | 4.0.3 | |
| horde | imp | 4.0.4 | |
| horde | imp | 4.1.3 | |
| horde | imp | 4.1.5 | |
| horde | imp | 4.1.6 | |
| horde | imp | 4.2 | |
| horde | imp | 4.2.1 | |
| horde | imp | 4.2.2 | |
| horde | imp | 4.3 | |
| horde | imp | 4.3.1 | |
| horde | imp | 4.3.2 | |
| horde | imp | 4.3.3 | |
| horde | imp | 4.3.4 | |
| horde | imp | 4.3.5 | |
| horde | imp | 4.3.6 | |
| horde | groupware | * | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0 | |
| horde | groupware | 1.0.1 | |
| horde | groupware | 1.0.2 | |
| horde | groupware | 1.0.3 | |
| horde | groupware | 1.0.4 | |
| horde | groupware | 1.0.5 | |
| horde | groupware | 1.0.6 | |
| horde | groupware | 1.0.7 | |
| horde | groupware | 1.0.8 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1 | |
| horde | groupware | 1.1.1 | |
| horde | groupware | 1.1.2 | |
| horde | groupware | 1.1.3 | |
| horde | groupware | 1.1.4 | |
| horde | groupware | 1.1.5 | |
| horde | groupware | 1.1.6 | |
| horde | groupware | 1.2 | |
| horde | groupware | 1.2 | |
| horde | groupware | 1.2.1 | |
| horde | groupware | 1.2.2 | |
| horde | groupware | 1.2.3 | |
| horde | groupware | 1.2.3 | |
| horde | groupware | 1.2.4 | |
| horde | groupware | 1.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "313CF637-CA8F-4AC0-BE3D-9D7B4125D81E",
"versionEndIncluding": "4.3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D2A8C5B-6155-4B40-B8C8-B4944064E3DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D11E08A4-79D6-46FE-880F-66E9778C298E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3894F-2E3F-49CA-BEE5-759D603F6EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDBDC41-7E6F-4C97-95BD-7DEB2D9FE837",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3B52D447-8E56-4E04-9650-38D222DA8D2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1C455353-0401-4975-89BC-C23D32A684F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D9D9E1-D8B7-4A56-BC2F-90BDC97322B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "59DE856E-98FF-4B49-BD7F-3E326FEB89EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6ED34889-9F98-46BC-9176-557484272C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B7FBC61D-6A08-4DE8-A5E5-A3FC57E7759D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E52AEEE6-2364-4CFB-9337-C5CCA54362E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD137160-B80D-4C65-A9A9-CEE12107E3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6C2AC8-C21A-4152-AAE6-915ACE65CB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1956C8F0-EB91-4322-85C1-6BE15AA13703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DEBEB-0C2D-4F6A-AF63-04990D2FD5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E004FA4-0180-458A-8E8C-8167EF684ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F0A1617-17D1-4C9F-A818-27321FD2FEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CDC19-43C3-4ACC-94B4-388BCC8A2203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9931A5B-CD0C-43A3-B32D-915FF4AF57D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDC69F98-A3B4-4573-AFE4-2069218B3454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4D0137-3515-4857-8E70-4600CD2D4278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A59756D1-3401-4B15-8B68-AA68B5BC3223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "73FD31BC-651B-461F-B9F4-6CA8D5CCE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "184592A5-4108-40DB-8882-9D2468490DE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "28470602-E3F1-4F04-B012-F91AB95E7A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B584932-BFB2-4462-BC69-B9FCC059F59F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "702F7A33-CF9E-4966-B622-E4BD27B120AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FF1BB456-5462-4ACE-AECF-730B1C7BE2CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1D23A341-217D-4AF2-AC61-DFC9761AFE3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C129AAEE-5388-4D81-AC1F-570EFF27EF89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "01CBF0CE-7133-4281-842C-3584AE13F36D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "373263B9-D967-4A9B-A062-FC841061E143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05FAFC4C-8E72-4EA5-930F-6F76CCD0138A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F91A26C3-D538-4935-90FF-DDD5E8733968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1F9064E7-6081-4B23-BC03-21E6F483FA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E60BFE2-B3E4-416F-9697-58D912907E86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C5D659-E2C1-444D-8B5C-28970D830F1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "72D702C7-2789-4837-BC74-59570B13B4C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1A363643-3EF2-4F05-A934-0187AF846D51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4611791C-DA55-4F37-9030-1BEA17D0D817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2C5EC486-EF14-43DF-9152-69456E0FE271",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D82E23DB-0652-4BA9-9D9A-0107BEC1EA31",
"versionEndIncluding": "1.2.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "71C2653B-7F0B-4628-9E77-44744BC05463",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E55009DF-EDF1-4FAE-88E7-1CF33BFFEBC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "980162BB-48B3-4921-987A-6D18C62965A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DC241F01-B9DF-4D0E-BA3C-3523AEEB6BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B574D428-0A3A-47CA-A926-5C936F83919A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D59C23FB-E223-4EED-8F69-3CC1EE7DF148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "904EEFF0-CF66-43E6-BAA9-1A6FB4115CB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B3AB0176-9CB3-4D49-B644-2C413C9B6E13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C95E9B57-2DB0-4692-A7D1-180EC3687D1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6E7D8683-8DD4-4EB0-A28F-0C556304BB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "9F68E5D5-7812-4FB2-ACF9-76180B038D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C6BBB036-494E-41D4-BD04-40906FAB5C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "37B76B27-ADF0-4E88-B92C-304FB38A356E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "965F245A-879A-4DF0-ABC5-588E78C4CBBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "3DCB29F9-3875-4264-8117-5751FEDC3350",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "59FC250F-EF0B-4604-99A2-3EEB8B2DEB77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1C10E681-5D2B-4EA4-B8E1-C0CA4FC9D3FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CC5154-42C5-4877-9147-5DFD61BD5CDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "62AAEBBF-1696-4EAC-8837-68A03C2D2F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F626876D-99FC-4DE0-BEE0-35874C4E25F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A849DD3E-882A-4621-BB6C-315A76677BB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AAF1A6AE-0748-476B-ACE2-DA43A9443B7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AB711B5E-9011-4BA2-917A-DB8545705E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "50DC1068-F426-497F-A5A0-E032BC3816F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C5A176-8C72-40EA-85AC-F11B40FD53A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CB4C3487-4556-47E5-8BF3-1DEDF0E9AFEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "78F24E43-491B-4AD1-B905-66F7FC6DA98D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F577A169-8354-4218-B3C6-04DA4BDF1E3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1FAFD66F-81F7-48F9-87F0-E394F55A1288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2BA91C75-69CF-45AE-AF23-ADE9259B7C9C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en fetchmailprefs.php in Horde IMP anterior a v4.3.8, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro fm_id en una acci\u00f3n fetchmail_prefs_save, relacionado con la configuraci\u00f3n de Fetchmail."
}
],
"id": "CVE-2010-3695",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-03-31T22:55:01.897",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"source": "secalert@redhat.com",
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"source": "secalert@redhat.com",
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41627"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43896"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8170"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde\u0026r1=1.699.2.424\u0026r2=1.699.2.430\u0026ty=h"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde\u0026r1=1.35.2.11\u0026r2=1.35.2.13\u0026ty=h"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde\u0026r1=1.39.4.10\u0026r2=1.39.4.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.horde.org/archives/announce/2010/000558.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2010/000568.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/09/30/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2010/10/01/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/43896"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2204"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/513992/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/43515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=641069"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-0463
Vulnerability from fkie_nvd - Published: 2010-01-29 18:30 - Updated: 2025-04-11 00:51
Severity ?
Summary
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://bugs.horde.org/ticket/8836 | Patch | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/56052 | ||
| cve@mitre.org | https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://bugs.horde.org/ticket/8836 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/56052 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | imp | * | |
| horde | imp | 2.0 | |
| horde | imp | 2.2 | |
| horde | imp | 2.2.1 | |
| horde | imp | 2.2.2 | |
| horde | imp | 2.2.3 | |
| horde | imp | 2.2.4 | |
| horde | imp | 2.2.5 | |
| horde | imp | 2.2.6 | |
| horde | imp | 2.2.7 | |
| horde | imp | 2.2.8 | |
| horde | imp | 2.3 | |
| horde | imp | 3.0 | |
| horde | imp | 3.1 | |
| horde | imp | 3.1.2 | |
| horde | imp | 3.2 | |
| horde | imp | 3.2.1 | |
| horde | imp | 3.2.2 | |
| horde | imp | 3.2.3 | |
| horde | imp | 3.2.4 | |
| horde | imp | 3.2.5 | |
| horde | imp | 3.2.6 | |
| horde | imp | 3.2.7 | |
| horde | imp | 3.2.7 | |
| horde | imp | 4.0 | |
| horde | imp | 4.0.1 | |
| horde | imp | 4.0.2 | |
| horde | imp | 4.0.3 | |
| horde | imp | 4.0.4 | |
| horde | imp | 4.1.3 | |
| horde | imp | 4.1.5 | |
| horde | imp | 4.1.6 | |
| horde | imp | 4.2 | |
| horde | imp | 4.2.1 | |
| horde | imp | 4.2.2 | |
| horde | imp | 4.3 | |
| horde | imp | 4.3.1 | |
| horde | imp | 4.3.2 | |
| horde | imp | 4.3.3 | |
| horde | imp | 4.3.4 | |
| horde | imp | 4.3.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4DB76A6D-CBEE-4B21-B9CB-25E797EF9D3F",
"versionEndIncluding": "4.3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D2A8C5B-6155-4B40-B8C8-B4944064E3DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D11E08A4-79D6-46FE-880F-66E9778C298E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3894F-2E3F-49CA-BEE5-759D603F6EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDBDC41-7E6F-4C97-95BD-7DEB2D9FE837",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3B52D447-8E56-4E04-9650-38D222DA8D2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1C455353-0401-4975-89BC-C23D32A684F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D9D9E1-D8B7-4A56-BC2F-90BDC97322B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "59DE856E-98FF-4B49-BD7F-3E326FEB89EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6ED34889-9F98-46BC-9176-557484272C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B7FBC61D-6A08-4DE8-A5E5-A3FC57E7759D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E52AEEE6-2364-4CFB-9337-C5CCA54362E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD137160-B80D-4C65-A9A9-CEE12107E3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6C2AC8-C21A-4152-AAE6-915ACE65CB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1956C8F0-EB91-4322-85C1-6BE15AA13703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DEBEB-0C2D-4F6A-AF63-04990D2FD5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E004FA4-0180-458A-8E8C-8167EF684ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F0A1617-17D1-4C9F-A818-27321FD2FEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CDC19-43C3-4ACC-94B4-388BCC8A2203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9931A5B-CD0C-43A3-B32D-915FF4AF57D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDC69F98-A3B4-4573-AFE4-2069218B3454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4D0137-3515-4857-8E70-4600CD2D4278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A59756D1-3401-4B15-8B68-AA68B5BC3223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "73FD31BC-651B-461F-B9F4-6CA8D5CCE583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "184592A5-4108-40DB-8882-9D2468490DE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "28470602-E3F1-4F04-B012-F91AB95E7A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B584932-BFB2-4462-BC69-B9FCC059F59F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "702F7A33-CF9E-4966-B622-E4BD27B120AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FF1BB456-5462-4ACE-AECF-730B1C7BE2CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1D23A341-217D-4AF2-AC61-DFC9761AFE3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C129AAEE-5388-4D81-AC1F-570EFF27EF89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "01CBF0CE-7133-4281-842C-3584AE13F36D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "373263B9-D967-4A9B-A062-FC841061E143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05FAFC4C-8E72-4EA5-930F-6F76CCD0138A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F91A26C3-D538-4935-90FF-DDD5E8733968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1F9064E7-6081-4B23-BC03-21E6F483FA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E60BFE2-B3E4-416F-9697-58D912907E86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C5D659-E2C1-444D-8B5C-28970D830F1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "72D702C7-2789-4837-BC74-59570B13B4C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1A363643-3EF2-4F05-A934-0187AF846D51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4611791C-DA55-4F37-9030-1BEA17D0D817",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
},
{
"lang": "es",
"value": "Horde IMP v4.3.6 y anteriores no solicitan que el navegador web permita el \"prefetching\" DNS de los nombres de dominio contenidos en mensajes de correo electr\u00f3nico, lo que facilita a atacantes remotos determinar la localizaci\u00f3n de red del usuario de webmail mediante peticiones de logggin DNS."
}
],
"id": "CVE-2010-0463",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-01-29T18:30:01.103",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://bugs.horde.org/ticket/8836"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"source": "cve@mitre.org",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://bugs.horde.org/ticket/8836"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2007-6018
Vulnerability from fkie_nvd - Published: 2008-01-11 02:46 - Updated: 2025-04-09 00:30
Severity ?
Summary
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
References
| URL | Tags | ||
|---|---|---|---|
| PSIRT-CNA@flexerasoftware.com | http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17&r2=1.17.2.1&ty=h | ||
| PSIRT-CNA@flexerasoftware.com | http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h | ||
| PSIRT-CNA@flexerasoftware.com | http://lists.horde.org/archives/announce/2008/000360.html | ||
| PSIRT-CNA@flexerasoftware.com | http://lists.horde.org/archives/announce/2008/000365.html | ||
| PSIRT-CNA@flexerasoftware.com | http://lists.horde.org/archives/announce/2008/000366.html | ||
| PSIRT-CNA@flexerasoftware.com | http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/28020 | Vendor Advisory | |
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/28546 | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/29184 | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/29185 | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/29186 | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/34418 | ||
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/secunia_research/2007-102/advisory/ | Vendor Advisory | |
| PSIRT-CNA@flexerasoftware.com | http://www.debian.org/security/2008/dsa-1470 | ||
| PSIRT-CNA@flexerasoftware.com | http://www.securityfocus.com/bid/27223 | Patch | |
| PSIRT-CNA@flexerasoftware.com | https://bugzilla.redhat.com/show_bug.cgi?id=428625 | ||
| PSIRT-CNA@flexerasoftware.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/39595 | ||
| PSIRT-CNA@flexerasoftware.com | https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html | ||
| PSIRT-CNA@flexerasoftware.com | https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17&r2=1.17.2.1&ty=h | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2008/000360.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2008/000365.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2008/000366.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/28020 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/28546 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/29184 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/29185 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/29186 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/34418 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/secunia_research/2007-102/advisory/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2008/dsa-1470 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/27223 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=428625 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/39595 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:framework:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8873E0B6-9A41-4D39-BB6F-06EF2F4BCB92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:groupware_webmail_edition:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "664B0D12-607C-4B5F-AC8E-FB1BBD1332E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:horde:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "96A4F9E2-7978-4C82-9BD3-B6B73C4918E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C129AAEE-5388-4D81-AC1F-570EFF27EF89",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) \"purge\" deleted emails via a crafted email message."
},
{
"lang": "es",
"value": "IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, y Horde Groupware Webmail Edition 1.0.3 no validan peticiones HTTP no especificadas, lo cual permite a atacantes remotos (1) borrar mensajes de correo electr\u00f3nico de su elecci\u00f3n mediante un ID num\u00e9rico modificado o (2) \"purgar\" correos electr\u00f3nicos eliminados mediante un mensaje de correo electr\u00f3nico manipulado."
}
],
"id": "CVE-2007-6018",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-01-11T02:46:00.000",
"references": [
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28020"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://secunia.com/advisories/28546"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://secunia.com/advisories/29184"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://secunia.com/advisories/29185"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://secunia.com/advisories/29186"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://secunia.com/advisories/34418"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17\u0026r2=1.17.2.1\u0026ty=h"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12\u0026r2=1.12.2.1\u0026ty=h"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2008/000360.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2008/000365.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.horde.org/archives/announce/2008/000366.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28020"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/28546"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29184"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34418"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/secunia_research/2007-102/advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1470"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/27223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=428625"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39595"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00888.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00927.html"
}
],
"sourceIdentifier": "PSIRT-CNA@flexerasoftware.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2007-1515
Vulnerability from fkie_nvd - Published: 2007-03-20 10:19 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html | Exploit, Vendor Advisory | |
| cve@mitre.org | http://lists.horde.org/archives/announce/2007/000316.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/24541 | ||
| cve@mitre.org | http://www.securityfocus.com/archive/1/462914/100/0/threaded | ||
| cve@mitre.org | http://www.securityfocus.com/bid/22975 | ||
| cve@mitre.org | http://www.securitytracker.com/id?1017774 | ||
| cve@mitre.org | http://www.vupen.com/english/advisories/2007/0964 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2007/000316.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/24541 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/archive/1/462914/100/0/threaded | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/22975 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1017774 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2007/0964 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50BC1694-27D6-4278-BC35-02D1ADC88D89",
"versionEndIncluding": "4.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Horde IMP H3 4.1.3 y, posiblemente, versiones anteriores, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante (1) la cabecera del Subject de los email en el thread.php,(2) el par\u00e1metro edit_query del search.php u otros par\u00e1metros sin especificar en el search.php. NOTA: algunos de los detalles se obtienen a partir de la informaci\u00f3n de terceros."
}
],
"id": "CVE-2007-1515",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-03-20T10:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/24541"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22975"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017774"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2007/000316.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/24541"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/462914/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017774"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0964"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2007-1474
Vulnerability from fkie_nvd - Published: 2007-03-16 21:19 - Updated: 2025-04-09 00:30
Severity ?
Summary
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489 | Vendor Advisory | |
| cve@mitre.org | http://lists.horde.org/archives/announce/2007/000315.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/27565 | ||
| cve@mitre.org | http://www.debian.org/security/2007/dsa-1406 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/22985 | ||
| cve@mitre.org | http://www.securitytracker.com/id?1017784 | ||
| cve@mitre.org | http://www.securitytracker.com/id?1017785 | ||
| cve@mitre.org | http://www.vupen.com/english/advisories/2007/0965 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/32997 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.horde.org/archives/announce/2007/000315.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/27565 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2007/dsa-1406 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/22985 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1017784 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id?1017785 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2007/0965 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/32997 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| horde | horde_application_framework | 3.0.0 | |
| horde | horde_application_framework | 3.0.4 | |
| horde | horde_application_framework | 3.1.3 | |
| horde | imp | 2.0 | |
| horde | imp | 2.2 | |
| horde | imp | 2.2.1 | |
| horde | imp | 2.2.2 | |
| horde | imp | 2.2.3 | |
| horde | imp | 2.2.4 | |
| horde | imp | 2.2.5 | |
| horde | imp | 2.2.6 | |
| horde | imp | 2.2.7 | |
| horde | imp | 2.2.8 | |
| horde | imp | 2.3 | |
| horde | imp | 3.0 | |
| horde | imp | 3.1 | |
| horde | imp | 3.1.2 | |
| horde | imp | 3.2 | |
| horde | imp | 3.2.1 | |
| horde | imp | 3.2.2 | |
| horde | imp | 3.2.3 | |
| horde | imp | 3.2.4 | |
| horde | imp | 3.2.5 | |
| horde | imp | 3.2.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:horde:horde_application_framework:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "76A5CF62-60DD-4EA7-A6C3-2061548EF1B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:horde_application_framework:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "78356C5F-A76E-4CB1-894D-0D882A665096",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:horde_application_framework:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B6E3FE20-264A-4496-8FB3-E59A3A38BAE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D2A8C5B-6155-4B40-B8C8-B4944064E3DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D11E08A4-79D6-46FE-880F-66E9778C298E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3894F-2E3F-49CA-BEE5-759D603F6EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDBDC41-7E6F-4C97-95BD-7DEB2D9FE837",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3B52D447-8E56-4E04-9650-38D222DA8D2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1C455353-0401-4975-89BC-C23D32A684F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D9D9E1-D8B7-4A56-BC2F-90BDC97322B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "59DE856E-98FF-4B49-BD7F-3E326FEB89EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6ED34889-9F98-46BC-9176-557484272C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B7FBC61D-6A08-4DE8-A5E5-A3FC57E7759D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E52AEEE6-2364-4CFB-9337-C5CCA54362E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD137160-B80D-4C65-A9A9-CEE12107E3DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6C2AC8-C21A-4152-AAE6-915ACE65CB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1956C8F0-EB91-4322-85C1-6BE15AA13703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DEBEB-0C2D-4F6A-AF63-04990D2FD5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E004FA4-0180-458A-8E8C-8167EF684ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F0A1617-17D1-4C9F-A818-27321FD2FEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CDC19-43C3-4ACC-94B4-388BCC8A2203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9931A5B-CD0C-43A3-B32D-915FF4AF57D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDC69F98-A3B4-4573-AFE4-2069218B3454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:imp:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "AD4D0137-3515-4857-8E70-4600CD2D4278",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de argumento en la secuencia de comandos cleanup para cron de Horde Project Horde e IMP anterior a Horde Application Framework 3.1.4 permite a usuarios locales borrar archivos de su elecci\u00f3n y posiblemente obtener privilegios mediante m\u00faltiples nombres de ruta separados por espacios."
}
],
"id": "CVE-2007-1474",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-03-16T21:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2007/000315.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27565"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2007/dsa-1406"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22985"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017784"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017785"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0965"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32997"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.horde.org/archives/announce/2007/000315.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27565"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2007/dsa-1406"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22985"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017784"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017785"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0965"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32997"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}