3.5

CVE-2005-4190

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horde ≫ Horde Application Framework Version1.0.2_1
Horde ≫ Horde Application Framework Version1.0.3_2
Horde ≫ Horde Application Framework Version1.0.3_3
Horde ≫ Horde Application Framework Version1.0.3_4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.6% 0.726
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/20960
Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_16_sr.html
http://www.sec-consult.com/245.html
http://www.securityfocus.com/bid/15808
http://lists.horde.org/archives/announce/2005/000238.html
Patch
http://secunia.com/advisories/17970
Patch
Vendor Advisory
http://secunia.com/advisories/19619
Vendor Advisory
http://secunia.com/advisories/19897
Vendor Advisory
http://www.debian.org/security/2006/dsa-1033
http://www.novell.com/linux/security/advisories/2006_04_28.html
http://www.securityfocus.com/bid/15802
http://www.securityfocus.com/bid/15803
http://www.securityfocus.com/bid/15804
http://www.securityfocus.com/bid/15806
http://www.securityfocus.com/bid/15810
http://www.vupen.com/english/advisories/2005/2835
Vendor Advisory