Vulnerabilities > Horde

DATE CVE VULNERABILITY TITLE RISK
2020-05-18 CVE-2020-8034 Cross-Site Scripting vulnerability in Horde Gollem and Groupware
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output.
network
horde CWE-79
4.3
2020-05-18 CVE-2020-8035 Cross-Site Scripting vulnerability in Horde Groupware
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload.
network
horde CWE-79
4.3
2020-03-23 CVE-2020-8866 Unrestricted Upload of File With Dangerous Type vulnerability in Horde Groupware 5.2.22
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22.
network
low complexity
horde CWE-434
4.0
2020-03-23 CVE-2020-8865 Path Traversal vulnerability in Horde Groupware 5.2.22
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22.
network
low complexity
horde CWE-22
6.5
2020-02-17 CVE-2020-8518 Code Injection vulnerability in multiple products
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
network
low complexity
horde fedoraproject CWE-94
7.5
2019-11-05 CVE-2013-6275 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
network
horde debian CWE-352
4.3
2019-11-05 CVE-2013-6365 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
network
high complexity
horde opensuse debian CWE-352
2.6
2019-11-05 CVE-2013-6364 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
network
horde debian CWE-352
6.8
2019-10-24 CVE-2019-12095 Cross-Site Request Forgery (CSRF) vulnerability in Horde Groupware
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server.
network
horde CWE-352
6.8
2019-10-24 CVE-2019-12094 Cross-Site Scripting vulnerability in Horde Groupware
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
network
horde CWE-79
4.3