Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
References (6)
Core 6
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59772
Various Sources mailing-list
x_refsource_mlist
http://lists.horde.org/archives/announce/2014/001025.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59770
Various Sources x_refsource_confirm
https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES
Various Sources x_refsource_confirm
https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES
Vendor Advisory mailing-list
x_refsource_mlist
http://lists.horde.org/archives/announce/2014/001019.html
Scores
EPSS
0.0047
EPSS Percentile
65.0%
Details
CWE
CWE-79
Status
published
Products (26)
horde/groupware
5.0.0 (2 CPE variants)
horde/groupware
5.0.1
horde/groupware
5.0.2
horde/groupware
5.0.3
horde/groupware
5.0.4
horde/groupware
5.0.5
horde/groupware
5.1.0 (2 CPE variants)
horde/groupware
5.1.1
horde/groupware
5.1.2
horde/groupware
5.1.3
... and 16 more
Published
Jul 14, 2014
Tracked Since
Feb 18, 2026