CVE

Id
25036  
CVE No.
CVE-2007-1679  
Status
Candidate  
Description
** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in (1) imp/search.php and (2) ingo/rule.php. NOTE: this issue has been disputed by the vendor, noting that the search.php issue was resolved in CVE-2006-4255, and attackers can only use rule.php to inject XSS into their own pages.  
Phase
Assigned (20070326)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
248964 25036 CVE-2007-1679 BUGTRAQ:20070325 Horde Webmail Multiple HTML Injection vulnerability  View
248965 25036 CVE-2007-1679 URL:http://www.securityfocus.com/archive/1/archive/1/463819/100/0/threaded  View
248966 25036 CVE-2007-1679 BUGTRAQ:20070326 Re: Horde Webmail Multiple HTML Injection vulnerability  View
248967 25036 CVE-2007-1679 URL:http://www.securityfocus.com/archive/1/archive/1/463911/100/0/threaded  View
248968 25036 CVE-2007-1679 BID:23136  View
248969 25036 CVE-2007-1679 URL:http://www.securityfocus.com/bid/23136  View
248970 25036 CVE-2007-1679 SREASON:2487  View
248971 25036 CVE-2007-1679 URL:http://securityreason.com/securityalert/2487  View
248972 25036 CVE-2007-1679 XF:horde-search-rule-xss(33228)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
51631 JVNDB-2007-000294 Sun Java Web Console の libwebconsole_services.so におけるフォーマットストリングの脆弱性 Sun Java Web Console の libwebconsole_services.so には、コンソールへの認証に失敗した際の処理に関連する、フォーマットストリングの脆弱性が存在します。 CVE-2007-1681 25036 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000294.html  View