{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Groupware Webmail Edition versions ant\u00e9rieures \u00e0 4.09",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware versions ant\u00e9rieures \u00e0 4.09",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Kronolith versions ant\u00e9rieures \u00e0 3.0.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTA-2012-AVI-660",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eHorde\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant d\u0027injecter du code indirecte \u00e0 distance (XSS) \u00e0 cause\nd\u0027entr\u00e9es non v\u00e9rifi\u00e9es dans le calendrier.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Horde du 14 novembre 2012",
      "url": "http://lists.horde.org/archives/announce/2012/000840.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Groupware versions 4.0.7 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail versions 4.0.7 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation). Les versions 4.0.8 corrigent le\nprobl\u00e8me.\n",
  "cves": [],
  "links": [
    {
      "title": "Notes de version Horde 772 et 773 du 29 mai 2012 :",
      "url": "http://lists.horde.org/archives/announce/2012/000772.html"
    },
    {
      "title": "Notes de version Horde 772 et 773 du 29 mai 2012 :",
      "url": "http://lists.horde.org/archives/announce/2012/000773.html"
    }
  ],
  "reference": "CERTA-2012-AVI-302",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-06-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s de type XSS \u003cspan class=\"textit\"\u003e(injection\nde code indirecte \u00e0 distance)\u003c/span\u003e ont \u00e9t\u00e9 corrig\u00e9es dans Horde\nGroupware. Ces vuln\u00e9rabilit\u00e9s, pr\u00e9sentes dans les fonctionnalit\u00e9s de\nmessagerie et de calendrier, permettent \u00e0 un utilisateur malintentionn\u00e9\nd\u0027ex\u00e9cuter du code dans le navigateur Web du client.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans les produits Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Note de version Horde 772 et 773 du 29 mai 2012",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Application Framework 3.3.10 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware 1.2.8 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail Edition 1.2.9 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type XSS peut \u00eatre exploit\u00e9e dans les produits\nHorde lors de l\u0027affichage d\u0027une vCard sp\u00e9cialement con\u00e7ue. Elle permet \u00e0\nun utilisateur malintentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire dans le\nnavigateur Web du client (HTML, JavaScript ...).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTA-2010-AVI-564",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-11-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type \u003cspan class=\"textit\"\u003eXSS\u003c/span\u003e (injection de\ncode indirecte \u00e0 distance) a \u00e9t\u00e9 d\u00e9couverte dans les logiciels Horde.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Notes de version Horde 574, 575 et 576 du 23 novembre 2010",
      "url": "http://list.horde.org/archives/announce/2010/000576.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde DIMP 1.1.4 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde IMP 4.3.7 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail Edition 1.2.6 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s de type XSS ont \u00e9t\u00e9 d\u00e9couvertes dans les\nproduits Horde. Elles permettent \u00e0 un utilisateur malintentionn\u00e9\nd\u0027ex\u00e9cuter du code arbitraire dans le navigateur Web du client (HTML,\nJavaScript, etc.).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Notes de version Horde 558, 561, et 568 du 28 septembre    2010 :",
      "url": "http://lists.horde.org/archives/announce/2010/000558.html"
    },
    {
      "title": "Notes de version Horde 558, 561, et 568 du 28 septembre    2010 :",
      "url": "http://lists.horde.org/archives/announce/2010/000561.html"
    },
    {
      "title": "Notes de version Horde 558, 561, et 568 du 28 septembre    2010 :",
      "url": "http://lists.horde.org/archives/announce/2010/000568.html"
    }
  ],
  "reference": "CERTA-2010-AVI-466",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-10-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s de type XSS (injection de code indirecte \u00e0\ndistance) ont \u00e9t\u00e9 d\u00e9couvertes dans les logiciels Horde.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans les produits Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Notes de version Horde 558, 561, et 568 du 28 septembre 2010",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde versions ant\u00e9rieures \u00e0 3.2.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde versions ant\u00e9rieures \u00e0 3.3.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware versions ant\u00e9rieures \u00e0 1.1.5.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Horde. Celles-ci concernent un\nmanque de contr\u00f4le de param\u00e8tres en entr\u00e9e pour les fichiers\ncloud_search.php et Image.php. Ceci peut \u00eatre exploit\u00e9 pour effectuer\nune injection de code indirecte et inclure des fichiers locaux.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Annonce de s\u00e9curit\u00e9 du 27 janvier 2009 pour Horde 3.3.3 :",
      "url": "http://lists.horde.org/archives/announce/2009/000482.html"
    },
    {
      "title": "Annonce de s\u00e9curit\u00e9 du 27 janvier 2009 pour Horde 3.2.4 :",
      "url": "http://lists.horde.org/archives/announce/2009/000483.html"
    },
    {
      "title": "Annonce de s\u00e9curit\u00e9 du 27 janvier 2009 pour Horde 1.1.5 :",
      "url": "http://lists.horde.org/archives/announce/2009/000486.html"
    }
  ],
  "reference": "CERTA-2009-AVI-036",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-01-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s dans Horde permettent \u00e0 une personne malintentionn\u00e9e\nd\u0027effectuer une injection de code indirecte (\u003cspan\nclass=\"textit\"\u003ecross-site scripting\u003c/span\u003e) et de contourner la\npolitique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonces de s\u00e9curit\u00e9 de la liste Horde",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "les versions Horde Groupware ant\u00e9rieures \u00e0 1.2.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "les versions Horde ant\u00e9rieures \u00e0 3.2.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Les versions Horde ant\u00e9rieures \u00e0 3.3.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "les versions Horde Groupware Webmail Edition ant\u00e9rieures \u00e0 1.1.4.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "les versions Horde Groupware Webmail Edition ant\u00e9rieures \u00e0 1.2.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "les versions Horde Groupware ant\u00e9rieures \u00e0 1.1.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type \u00ab injection de code indirecte \u00bb a \u00e9t\u00e9\nidentifi\u00e9e dans plusieurs produits Horde. Le filtrage XSS n\u0027est pas\ncorrectement effectu\u00e9 dans certaines conditions.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-5917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-5917"
    }
  ],
  "links": [
    {
      "title": "Page officielle du projet Horde\u00a0:",
      "url": "http://www.horde.org/"
    },
    {
      "title": "Site de t\u00e9l\u00e9chargement Horde\u00a0:",
      "url": "http://ftp.horde.org/pub/horde/"
    }
  ],
  "reference": "CERTA-2009-AVI-025",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-01-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de type \u00ab injection de code indirecte \u00bb a \u00e9t\u00e9\nidentifi\u00e9e dans plusieurs produits Horde.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans des produits Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonces de mises \u00e0 jour Horde du 20 janvier 2009",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Application Framework versions 3.2.2 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupeware Webmail Edition versions 1.0.7 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Application Framework versions 3.1.8 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupeware Webmail Edition versions 1.1.2 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupeware versions 1.0.6 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupeware versions 1.1.2 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans plusieurs produits Horde comme\nGroupeware, Groupeware Webmail Edition et Application Framework. Ces\nvuln\u00e9rabilit\u00e9s sont relatives \u00e0 la mise en \u0153uvre d\u0027extensions MIME ou\nbien \u00e0 la gestion de certains caract\u00e8res d\u0027\u00e9chappement. Elles permettent\n\u00e0 un utilisateur distant malintentionn\u00e9 de r\u00e9aliser des attaques de type\n\u00ab injection de code indirecte \u00bb (cross-site scripting).\n\n## Contournement provisoire\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-3823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3823"
    },
    {
      "name": "CVE-2008-3824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3824"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de l\u0027oCERT :",
      "url": "http://www.ocert.org/advisories/ocert-2008-012.html"
    }
  ],
  "reference": "CERTA-2008-AVI-458",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans les produits Horde et\npermettent \u00e0 un utilisateur distant malintentionn\u00e9 de r\u00e9aliser des\nattaques de type \u00ab injection de code indirecte \u00bb (\u003cspan\nclass=\"textit\"\u003ecross-site scripting\u003c/span\u003e).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Horde",
      "url": "http://marc.info/?l=horde-announce\u0026m=122103888111491\u0026w=2"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Groupware Webmail Edition version 1.1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail Edition versions 1.0.6 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde version 3.2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware version 1.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware versions 1.0.5 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde versions 3.1.7 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Horde. Celles-ci\npermettent de r\u00e9aliser des attaques de type cross-site scripting.\nCertaines n\u00e9cessitent de s\u0027\u00eatre authentifi\u00e9 au pr\u00e9alable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Annonce de la version 1.0.7 de Horde    Groupware Webmail Edition du 13 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000418.html"
    },
    {
      "title": "Annonce de la version 1.1.1 de Horde    Groupware du 13 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000419.html"
    },
    {
      "title": "Annonce de la version 1.1.1 de Horde    Groupware Webmail Edition du 14 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000420.html"
    },
    {
      "title": "Annonce de la version 3.2.1 de Horde du 13 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000416.html"
    },
    {
      "title": "Annonce de la version 3.1.8 de Horde du 13 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000415.html"
    },
    {
      "title": "Annonce de la version 1.0.6 de Horde    Groupware du 13 juin 2008 :",
      "url": "http://lists.horde.org/archives/announce/2008/000417.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Fedora 9 FEDORA-2008-5683 du 25 juin    2008 :",
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-June/msg00954.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Fedora 8 FEDORA-2008-5691 du 25 juin    2008 :",
      "url": "http://www.redhat.com/archives/fedora-package-announce/2008-June/msg00959.html"
    }
  ],
  "reference": "CERTA-2008-AVI-323",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-06-17T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Fedora.",
      "revision_date": "2008-06-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eHorde\u003c/span\u003e permettent de\nr\u00e9aliser des attaques de type \u003cspan class=\"textit\"\u003ecross-site\nscripting\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonces des nouvelles versions de Horde du 13 juin 2008",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Groupware versions 1.0.4 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Application Framework versions 3.1.6 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail Edition versions 1.0.5 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le traitement du param\u00e8tre theme\ndans Horde. Un utilisateur authentifi\u00e9 mal intentionn\u00e9 peut, par le\nbiais d\u0027une requ\u00eate POST sp\u00e9cifiquement construite, inclure un fichier \u00e0\ndistance et le faire ex\u00e9cuter.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Correctif pour Horde Groupware    :",
      "url": "http://lists.horde.org/archives/announce/2008/000383.html"
    },
    {
      "title": "Correctif pour Horde Groupware Webmail    Edition :",
      "url": "http://lists.horde.org/archives/announce/2008/000384.html"
    },
    {
      "title": "Correctif pour Horde Application    Framework :",
      "url": "http://lists.horde.org/archives/announce/2008/000382.html"
    }
  ],
  "reference": "CERTA-2008-AVI-121",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-03-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eHorde\u003c/span\u003e permet \u00e0 un\nutilisateur authentifi\u00e9 d\u0027inclure un fichier \u00e0 distance et de\nl\u0027ex\u00e9cuter.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Horde",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonces Horde du 07 et 08 mars 2008",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Application Framework 3.1.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Groupware Webmail Edition 1.0.3.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "IMP Webmail 4.1.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe filtre HTML ne filtre pas les \u00e9l\u00e9ments de type \\\u003cFrame\\\u003e\u00a0 et\n\\\u003cFrameset\\\u003e. De plus, certains utilisateurs peuvent adresser des\nrequ\u00eates via HTTP, sans v\u00e9rification de validit\u00e9. Cela peut servir \u00e0\neffacer des messages et \u00e0 les purger de la corbeille. L\u0027exploitation de\ncette vuln\u00e9rabilit\u00e9 exige l\u0027ouverture du message malveillant par la\nvictime.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-6018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6018"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200802-03 du 11 f\u00e9vrier    2008 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200802-03.xml"
    },
    {
      "title": "Site de t\u00e9l\u00e9chargement du projet Horde :",
      "url": "http://ftp.horde.org/pub/horde/patches/patch-horde-3.1.5-3.1.6.gz"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1470-1 du 20 janvier 2008 :",
      "url": "http://lists.debian.org/debian-security-announce/debian-security-announce-2008/msg00030.html"
    },
    {
      "title": "Site de t\u00e9l\u00e9chargement du projet Horde :",
      "url": "http://ftp.horde.org/pub/horde/horde-3.1.6.tar.gz"
    }
  ],
  "reference": "CERTA-2008-AVI-032",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2008-01-21T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Debian et Gentoo.",
      "revision_date": "2008-02-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de Horde permet d\u0027ex\u00e9cuter du code abitraire \u00e0\ndistance, de contourner la politique de s\u00e9curit\u00e9 ou de porter atteinte \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de Horde3",
  "vendor_advisories": []
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde IMP versions 4.1.2 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde IMP versions 4.0.4 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUn manque de contr\u00f4le sur le nom des r\u00e9pertoires pass\u00e9s en param\u00e8tres \u00e0\nHorde IMP permet \u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027injecter une\npage web ou du script arbitraire dans le contexte du navigateur de la\nvictime consultant le site vuln\u00e9rable.\n\n## Solution\n\nLes versions 4.0.5 et 4.1.3 de Horde IMP corrigent le probl\u00e8me :\n\n    http://ftp.horde.org/pub/imp/imp-h3-4.0.5.tar.gz\n\n    http://ftp.horde.org/pub/imp/imp-h3-4.1.3.tar.gz\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Horde #294 concernant la version 4.1.3    :",
      "url": "http://lists.horde.org/archives/announce/2006/000294.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Horde #293 concernant la version 4.0.5    :",
      "url": "http://lists.horde.org/archives/announce/2006/000293.html"
    }
  ],
  "reference": "CERTA-2006-AVI-368",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-08-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Cross-site scripting"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans Horde IMP permettent \u00e0 un utilisateur\ndistant mal intentionn\u00e9 de r\u00e9aliser une attaque de type Cross-Site\nScripting.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Horde IMP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Horde #293 et #294 du 17 ao\u00fbt 2006",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Application Framework versions 3.1.2 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Application Framework versions 3.0.11 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux erreurs ont \u00e9t\u00e9 identifi\u00e9es dans le fichier index.php de Horde\nApplication Framework 3. Un manque de contr\u00f4le sur les param\u00e8tres pass\u00e9s\n\u00e0 ce fichier permet \u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027injecter\nune page web ou du script arbitraire dans le contexte du navigateur de\nla victime consultant le site vuln\u00e9rable.\n\n## Solution\n\nLes versions 3.0.12 et 3.1.3 de Horde Application Framework corrigent le\nprobl\u00e8me :\n\n    http://ftp.horde.org/pub/horde/horde-3.0.12.tar.gz\n\n    http://ftp.horde.org/pub/horde/horde-3.1.3.tar.gz\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Horde #291 concernant la version    3.0.12 :",
      "url": "http://lists.horde.org/archives/announce/2006/000291.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Horde #292 concernant la version 3.1.3    :",
      "url": "http://lists.horde.org/archives/announce/2006/000292.html"
    },
    {
      "title": "Bulletin de securit\u00e9 FreeBSD du 17 ao\u00fbt 2006 :",
      "url": "http://www.vuxml.org/freebsd/index.html"
    }
  ],
  "reference": "CERTA-2006-AVI-366",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-08-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Cross-site scripting"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans Horde Application Framework 3\npermettent \u00e0 un utilisateur distant mal intentionn\u00e9 de r\u00e9aliser une\nattaque de type Cross-Site Scripting.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Horde Application Framework 3",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Horde #291 et #292 du 17 ao\u00fbt 2006",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horde Application Framework versions 3.0.10 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    },
    {
      "description": "Horde Application Framework versions 3.1.1 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Horde",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s de type cross site scripting ont \u00e9t\u00e9 d\u00e9couvertes dans\nHorde Application Framework.\n\n## Solution\n\nLes vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans le r\u00e9pertoire CVS de Horde.\nCertains \u00e9diteurs ont adapt\u00e9 ces modifications et ont publi\u00e9 des\nbulletins de s\u00e9curit\u00e9 (voir Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-2195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-2195"
    }
  ],
  "links": [
    {
      "title": "Site Internet de Horde :",
      "url": "http://www.horde.org"
    },
    {
      "title": "Modifications dans le r\u00e9pertoire CVS de Horde :",
      "url": "http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc\u0026r1=2.25\u0026r2=2.26"
    },
    {
      "title": "Modifications dans le r\u00e9pertoire CVS de Horde :",
      "url": "http://cvs.horde.org/diff.php?f=horde%2Ftest.php\u0026r1=1.145\u0026r2=1.146"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200606-28 du 29 juin 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200606-28.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA 1098 du 14 juin 2006 :",
      "url": "http://www.debian.org/security/2006/dsa-1098"
    }
  ],
  "reference": "CERTA-2006-AVI-263",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-06-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9s dans Horde Application Framework 3",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "R\u00e9pertoire CVS de Horde",
      "url": null
    }
  ]
}