|
|
| |
|
| |
horde3: multiple vulnerabilities
| Package(s): | horde3 |
CVE #(s): | CVE-2009-0932
CVE-2008-3330
CVE-2008-5917
|
| Created: | April 8, 2009 |
Updated: | April 1, 2010 |
| Description: |
From the Debian advisory:
Gunnar Wrobel discovered a directory traversal vulnerability, which
allows attackers to include and execute arbitrary local files via the
driver parameter in Horde_Image. CVE-2009-0932
It was discovered that an attacker could perform a cross-site scripting
attack via the contact name, which allows attackers to inject arbitrary
html code. This requires that the attacker has access to create
contacts. CVE-2008-3330
It was discovered that the horde XSS filter is prone to a cross-site
scripting attack, which allows attackers to inject arbitrary html code.
This is only exploitable when Internet Explorer is used. CVE-2008-5917
|
| Alerts: |
|
( Log in to post comments)
|
|
|