Vulnerabilities > Horde > Horde Application Framework > 3.2

DATE CVE VULNERABILITY TITLE RISK
2014-04-01 CVE-2014-1691 Code Injection vulnerability in Horde Application Framework
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
network
low complexity
horde CWE-94
7.5
2010-11-09 CVE-2010-3694 Cross-Site Request Forgery (CSRF) vulnerability in Horde Application Framework
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form.
network
horde CWE-352
6.8
2010-11-09 CVE-2010-3077 Cross-Site Scripting vulnerability in Horde Application Framework
Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML via the subdir parameter.
network
horde CWE-79
4.3
2009-09-17 CVE-2009-3237 Cross-Site Scripting vulnerability in Horde products
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).
network
horde CWE-79
4.3