Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.
References (6)
Core 6
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59772
Vendor Advisory mailing-list
x_refsource_mlist
http://lists.horde.org/archives/announce/2014/001025.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59770
Various Sources x_refsource_confirm
https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES
Various Sources x_refsource_confirm
https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES
Vendor Advisory mailing-list
x_refsource_mlist
http://lists.horde.org/archives/announce/2014/001019.html
Scores
EPSS
0.0052
EPSS Percentile
66.8%
Details
CWE
CWE-79
Status
published
Products (26)
horde/groupware
5.0.0 (2 CPE variants)
horde/groupware
5.0.1
horde/groupware
5.0.2
horde/groupware
5.0.3
horde/groupware
5.0.4
horde/groupware
5.0.5
horde/groupware
5.1.0 (2 CPE variants)
horde/groupware
5.1.1
horde/groupware
5.1.2
horde/groupware
5.1.3
... and 16 more
Published
Jul 14, 2014
Tracked Since
Feb 18, 2026