IM
Product
imp
23
CVEs
0
On KEV
6.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 3Low 0
Watch
Add imp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58451 | 6.5 | Jul 1 | Horde IMP < 7.0.1 Path Traversal via Compose.php img src Affected: before 7.0.1 |
| CVE-2026-65053 | 6.1 | Aug 24 | Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name Affected: before 7.2.0 |
| CVE-2002-2024 | 5.3 | Dec 31 | Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4)… Affected: 2.2.7 |
| CVE-2012-6640 | – | Apr 5 | Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to… Affected: through 5.0.21; 5.0; 5.0; 5.0; 5.0; 5.0; +20 more |
| CVE-2012-5565 | – | Apr 5 | Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows… Affected: through 5.0.23; 5.0.4; 5.0.5; 5.0.6; 5.0.7; 5.0.8; +14 more |
| CVE-2012-0791 | – | Jan 24 | Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +34 more |
| CVE-2010-4778 | – | Apr 1 | Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to… Affected: through 4.3.7; 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; +34 more |
| CVE-2010-3695 | – | Mar 31 | Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject… Affected: through 4.3.7; 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; +34 more |
| CVE-2010-0463 | – | Jan 29 | Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to… Affected: through 4.3.6; 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; +34 more |
| CVE-2007-6018 | – | Jan 11 | IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers… Affected: 4.1.5 |
| CVE-2007-1515 | – | Mar 20 | Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email… Affected: through 4.1.3 |
| CVE-2007-1474 | – | Mar 16 | Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +15 more |
| CVE-2006-4255 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +19 more |
| CVE-2005-4080 | – | Dec 8 | Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +19 more |
| CVE-2005-1319 | – | May 2 | Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title Affected: through 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; 3.2.7; +1 more |
| CVE-2004-1443 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used with Internet Explorer, allows remote… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +13 more |
| CVE-2004-0584 | – | Aug 6 | Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +12 more |
| CVE-2003-0025 | – | Jan 17 | Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain… Affected: 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +3 more |
| CVE-2002-0181 | – | Apr 22 | Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users… Affected: 2.2.8 |
| CVE-2001-0744 | – | Oct 18 | Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file Affected: through 2.2.4; 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3 |
| CVE-2001-1257 | – | Jul 21 | Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +1 more |
| CVE-2001-1258 | – | Jul 21 | Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file… Affected: 2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +1 more |
| CVE-2000-0911 | – | Dec 19 | IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as… Affected: 2.0; 2.2 |
Showing 23