Published: 13/04/2016 Updated: 18/06/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware prior to 5.2.12 and Horde Groupware Webmail Edition prior to 5.2.12 allows remote malicious users to inject arbitrary web script or HTML via vectors involving numeric form fields.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 23
fedoraproject fedora 22
horde groupware 5.2.11
debian debian linux 8.0

Debian Bug report logs - #813590 php-horde-core: CVE-2015-8807: XSS in Horde_Core_VarRenderer_Html Package: php-horde-core; Maintainer for php-horde-core is Horde Maintainers <team+debian-horde-team@trackerdebianorg>; Source for php-horde-core is src:php-horde-core (PTS, buildd, popcon) Reported by: Mathieu Parent <math ...

It was discovered that php-horde-core, a set of classes providing the core functionality of the Horde Application Framework, is prone to a cross-site scripting vulnerability For the stable distribution (jessie), this problem has been fixed in version 2150+debian0-1+deb8u1 For the testing distribution (stretch), this problem has been fixed in ve ...

CWE-79 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html http://lists.horde.org/archives/announce/2016/001148.html http://www.debian.org/security/2016/dsa-3496 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html http://lists.horde.org/archives/announce/2016/001149.html https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253 http://www.openwall.com/lists/oss-security/2016/02/06/4 http://www.openwall.com/lists/oss-security/2016/02/06/5 https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813590 https://nvd.nist.gov https://www.debian.org/security/./dsa-3496

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-8807

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect