horde: cross-site scripting
| Package(s): | horde |
CVE #(s): | CVE-2010-3077
CVE-2010-3694
|
| Created: | November 5, 2010 |
Updated: | July 18, 2011 |
| Description: |
From the Red Hat bugzilla:
a deficiency in the way Horde framework sanitized user-provided
'subdir' parameter, when composing final path to the image file.
A remote, unauthenticated user could use this flaw to conduct
cross-site scripting attacks (execute arbitrary HTML or scripting
code) by providing a specially-crafted URL to the running
Horde framework instance.
|
| Alerts: |
|
