Michael J Rubinsky

3 exploits Active since Nov 2017
CVE-2017-16906 WRITEUP MEDIUM WRITEUP
Horde Groupware <5.2.22 - XSS
In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.
CVSS 5.4
CVE-2017-16907 WRITEUP MEDIUM WRITEUP
Horde Groupware <5.2.21 - XSS
In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
CVSS 5.4
CVE-2017-16908 WRITEUP MEDIUM WRITEUP
Horde Groupware 5.2.19 - XSS
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
CVSS 5.4