GR
Product
Groupware
46
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 16Low 0
Watch
Add Groupware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-8518 | 9.8 | Feb 17 | Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution Affected: 5.2.22 |
| CVE-2013-6364 | 8.8 | Nov 5 | Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book Affected: 5.1.2 |
| CVE-2019-12095 | 8.8 | Oct 24 | Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a… Affected: through 5.2.22 |
| CVE-2019-9858 | 8.8 | May 29 | Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17 Affected: 5.2.17; 5.2.22 |
| CVE-2017-7413 | 8.8 | Apr 4 | In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has… Affected: through 5.2.17 |
| CVE-2022-30287 | 8.0 | Jul 28 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class Affected: through 5.2.22 |
| CVE-2017-15235 | 7.5 | Oct 11 | The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that… Affected: 5.2.21 |
| CVE-2017-7414 | 7.5 | Apr 4 | In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's… Affected: 5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +17 more |
| CVE-2020-8866 | 6.5 | Mar 23 | This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22 Affected: 5.2.22 |
| CVE-2013-6275 | 6.5 | Nov 5 | Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php Affected: through 5.1.2 |
| CVE-2020-8865 | 6.3 | Mar 23 | This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22 Affected: 5.2.22 |
| CVE-2021-26929 | 6.1 | Feb 14 | An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used) Affected: through 5.2.22 |
| CVE-2020-8034 | 6.1 | May 18 | Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET… Affected: 5.2.22 |
| CVE-2020-8035 | 6.1 | May 18 | The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a… Affected: before 5.2.22 |
| CVE-2019-12094 | 6.1 | Oct 24 | Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app=… Affected: through 5.2.22 |
| CVE-2016-5303 | 6.1 | Dec 20 | Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject… Affected: 5.2.15; 5.2.15 |
| CVE-2016-2228 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows… Affected: through 5.2.11 |
| CVE-2015-8807 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and… Affected: 5.2.11; 5.2.11 |
| CVE-2017-16908 | 5.4 | Nov 20 | In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource Affected: 5.2.19 |
| CVE-2017-16907 | 5.4 | Nov 20 | In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action Affected: 5.2.19; 5.2.21 |
| CVE-2017-16906 | 5.4 | Nov 20 | In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action Affected: 5.2.19 through 5.2.22 |
| CVE-2007-1679 | 5.4 | Mar 26 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors… Affected: 1.0 |
| CVE-2025-41066 | 5.3 | Dec 2 | Disclosure of sensitive information in Horde Groupware Affected: 5.2.22 |
| CVE-2013-6365 | 5.3 | Nov 5 | Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions Affected: 5.1.2 |
| CVE-2015-7984 | – | Nov 19 | Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote… Affected: 5.0.0 before 5.2.11; 5.0.0 before 5.2.11 |
| CVE-2014-4946 | – | Jul 14 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote… Affected: through 5.1.4; 5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; +7 more |
| CVE-2014-4945 | – | Jul 14 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote… Affected: through 5.1.4; 5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; +7 more |
| CVE-2012-6640 | – | Apr 5 | Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to… Affected: through 4.0.8; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +5 more |
| CVE-2012-5567 | – | Apr 5 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote… Affected: through 4.0.8; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +5 more |
| CVE-2012-5566 | – | Apr 5 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote… Affected: through 4.0.7; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +4 more |
| CVE-2012-5565 | – | Apr 5 | Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows… Affected: through 4.0.8; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +5 more |
| CVE-2012-0209 | – | Sep 25 | Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced… Affected: 1.2.10; 1.2.10 |
| CVE-2010-3693 | – | Apr 1 | Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary… Affected: through 1.2.6; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +25 more |
| CVE-2010-4778 | – | Apr 1 | Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to… Affected: through 1.2.6; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +25 more |
| CVE-2010-3695 | – | Mar 31 | Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject… Affected: through 1.2.6; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +25 more |
| CVE-2009-4363 | – | Dec 21 | Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not… Affected: through 1.2.4; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2009-3701 | – | Dec 21 | Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware… Affected: through 1.2.4; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2009-3237 | – | Sep 17 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and… Affected: 1.1; 1.1; 1.1; 1.1; 1.1; 1.1.1; +10 more |
| CVE-2009-3236 | – | Sep 17 | The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before… Affected: 1.1; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; +21 more |
| CVE-2008-7219 | – | Sep 13 | Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0… Affected: 1.0; 1.0.1; 1.0.2; 1.1 |
| CVE-2008-7218 | – | Sep 13 | Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before… Affected: 1.0; 1.0.1; 1.0.2; 1.1 |
| CVE-2008-2783 | – | Jun 19 | Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via… Affected: All versions, or not specified |
| CVE-2008-1974 | – | Apr 27 | Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary… Affected: 1.0.5 |
| CVE-2008-1284 | – | Mar 11 | Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote… Affected: through 1.0.4 |
| CVE-2008-0807 | – | Feb 19 | lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware… Affected: 1.0.3 |
| CVE-2007-0579 | – | Jan 30 | Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via… Affected: 1.0_rc2; 1.0_rc3 |
Showing 46