Vulnerabilities > Horde > Groupware > 1.1.6

DATE CVE VULNERABILITY TITLE RISK
2022-07-28 CVE-2022-30287 Unsafe Reflection vulnerability in multiple products
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.
network
low complexity
horde debian CWE-470
8.0
2021-02-14 CVE-2021-26929 Cross-site Scripting vulnerability in multiple products
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used).
network
horde debian CWE-79
4.3
2020-05-18 CVE-2020-8035 Cross-site Scripting vulnerability in Horde Groupware
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload.
network
horde CWE-79
4.3
2019-11-05 CVE-2013-6275 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
network
horde debian CWE-352
4.3
2019-10-24 CVE-2019-12095 Cross-Site Request Forgery (CSRF) vulnerability in Horde Groupware
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server.
network
horde CWE-352
6.8
2019-10-24 CVE-2019-12094 Cross-site Scripting vulnerability in Horde Groupware
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
network
horde CWE-79
4.3
2017-04-04 CVE-2017-7413 OS Command Injection vulnerability in Horde Groupware
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
network
low complexity
horde CWE-78
critical
9.0
2016-04-13 CVE-2016-2228 Cross-site Scripting vulnerability in multiple products
Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplorer/gollem/manager.php.
4.3
2014-07-14 CVE-2014-4946 Cross-Site Scripting vulnerability in Horde Groupware and Internet Mail Program
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
network
horde CWE-79
4.3
2014-07-14 CVE-2014-4945 Cross-Site Scripting vulnerability in Horde Groupware and Internet Mail Program
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.
network
horde CWE-79
4.3