← Back

Horde

horde

114 CVEs • 36 products

Products (36)

Click to collapse
Toggle
Groupware
groupware
46 CVEs
Imp
imp
21 CVEs
Horde
horde
18 CVEs
Groupware Webmail Edition
groupware_webmail_edition
10 CVEs
Horde Application Framework
horde_application_framework
9 CVEs
Application Framework
application_framework
8 CVEs
Kronolith
kronolith
3 CVEs
Kronolith H3
kronolith_h3
3 CVEs
Turba H3
turba_h3
3 CVEs
Kronolith H4
kronolith_h4
3 CVEs
Passwd
passwd
2 CVEs
Mnemo H3
mnemo_h3
2 CVEs
Nag H3
nag_h3
2 CVEs
Horde Groupware
horde_groupware
2 CVEs
Gollem
gollem
2 CVEs
Dynamic Imp
dynamic_imp
2 CVEs
Internet Mail Program
internet_mail_program
2 CVEs
Horde Image Api
horde_image_api
2 CVEs
Horde Imp
horde_imp
2 CVEs
Chora
chora
1 CVE
Turba
turba
1 CVE
Accounts
accounts
1 CVE
Forwards
forwards
1 CVE
Mnemo
mnemo
1 CVE
Vaction
vaction
1 CVE
Nag
nag
1 CVE
Nag Task List Manager H3
nag_task_list_manager_h3
1 CVE
Ingo H3
ingo_h3
1 CVE
Framework
framework
1 CVE
Turba Contact Manager
turba_contact_manager
1 CVE
Turba Contact Manager H3
turba_contact_manager_h3
1 CVE
Horde Image
horde_image
1 CVE
Horde Ldap
horde_ldap
1 CVE
Horde Form
horde_form
1 CVE
Horde Mime Viewer
horde_mime_viewer
1 CVE
Mnemo Note Manager H3
mnemo_note_manager_h3
0 CVEs

CVEs (114)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-1491
1Horde
1Application Framework
Apr 16, 2026
Mar 29, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.
CVE-2006-1260
1Horde
1Horde
Apr 16, 2026
Mar 19, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.
CVE-2005-4242
1Horde
1Turba H3
Apr 16, 2026
Dec 14, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the address book and (2) contact data.
CVE-2005-4191
1Horde
1Nag Task List Manager H3
Apr 16, 2026
Dec 13, 2005
N/A· v4
N/A· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the...Show more
Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist's name or (2) description, when creating a new tasklist.Show less
CVE-2005-4190
1Horde
1Horde Application Framework
Apr 16, 2026
Dec 13, 2005
N/A· v4
N/A· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the ide...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.Show less
CVE-2005-4189
1Horde
1Kronolith H3
Apr 16, 2026
Dec 13, 2005
N/A· v4
N/A· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2)...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.Show less
CVE-2005-4080
1Horde
1Imp
Apr 16, 2026
Dec 8, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be e...Show more
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.Show less
CVE-2005-3759
1Horde
1Horde
Apr 16, 2026
Nov 22, 2005
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) gzip/tar and (2) css MIME viewers, which do not filter or escape dangero...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) gzip/tar and (2) css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments.Show less
CVE-2005-3570
1Horde
1Horde
Apr 16, 2026
Nov 16, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Unspecified cross-site scripting (XSS) vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages".
CVE-2005-3344
1Horde
1Horde
Apr 16, 2026
Nov 16, 2005
N/A· v4
N/A· v3
10.0 HIGH· v2
The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
CVE-2005-1322
1Horde
1Nag
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Nag Task List Manager before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1321
1Horde
1Vaction
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Vacation module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1320
1Horde
1Mnemo
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Mnemo Note Manager before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1319
1Horde
1Imp
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1318
1Horde
1Forwards
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Forwards E-Mail Forwarding Manager before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1316
1Horde
1Accounts
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Accounts module before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1315
1Horde
1Turba
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Turba module before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1314
1Horde
1Kronolith
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Kronolith module before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-1313
1Horde
1Passwd
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde Passwd module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVE-2005-0961
1Horde
1Application Framework
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via the parent frame title.