Vulnerabilities > Horde > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-07-28 | CVE-2022-30287 | Unsafe Reflection vulnerability in multiple products Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. | 8.0 |
| 2019-11-05 | CVE-2013-6364 | Cross-site Scripting vulnerability in multiple products Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book | 8.8 |
| 2019-10-24 | CVE-2019-12095 | Cross-site Scripting vulnerability in Horde Groupware Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. | 8.8 |
| 2019-05-29 | CVE-2019-9858 | Path Traversal vulnerability in multiple products Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. | 8.8 |
| 2018-04-10 | CVE-2014-3999 | Improper Authentication vulnerability in Horde Ldap The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. | 8.1 |
| 2017-10-11 | CVE-2017-15235 | Forced Browsing vulnerability in Horde Groupware 5.2.21 The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename. | 7.5 |
| 2017-09-21 | CVE-2017-14650 | Improper Input Validation vulnerability in Horde Image API A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. | 8.1 |
| 2017-06-21 | CVE-2017-9774 | Code Injection vulnerability in Horde Image API Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. | 8.8 |
| 2017-04-04 | CVE-2017-7414 | OS Command Injection vulnerability in Horde Groupware In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. | 7.5 |
| 2017-04-04 | CVE-2017-7413 | OS Command Injection vulnerability in Horde Groupware In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address. | 8.8 |