Skip to content
Noroxi

Horde records

115 published records for vendor horde.

Researcher profile

Entered KEV
0 · 0%
Weaponized
4 · 3.5%
Pre-auth RCE
10
With a fix record
59.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

115 records
  • CVE-2020-8518
    61This week

    Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    horde · groupwareFeb 17, 2020

  • CVE-2022-30287
    53Plan

    Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class

    HighCVSS 8.0No exploitEPSS 69%

    horde · groupwareJul 28, 2022

  • CVE-2012-0209
    52Plan

    Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2

    HighCVSS 7.5WeaponizedEPSS 71%

    horde · groupwareSep 25, 2012

  • CVE-2017-7413
    47Plan

    In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an

    HighCVSS 8.8No exploitEPSS 39%

    horde · groupwareApr 4, 2017

  • CVE-2014-1691
    43Plan

    The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject

    HighCVSS 7.5WeaponizedEPSS 42%

    horde · horde application frameworkApr 1, 2014

  • CVE-2006-1491
    42Plan

    Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execu

    HighCVSS 7.5Proof of conceptEPSS 39%

    horde · application frameworkMar 29, 2006

  • CVE-2005-3344
    42Plan

    The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain acce

    CriticalCVSS 10.0Proof of conceptEPSS 7%

    horde · hordeNov 16, 2005

  • CVE-2019-9858
    41Plan

    Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.

    HighCVSS 8.8WeaponizedEPSS 18%

    horde · groupwareMay 29, 2019

  • CVE-2008-7219
    41Plan

    Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3

    CriticalCVSS 10.0No exploitEPSS 2%

    horde · groupwareSep 13, 2009

  • CVE-2008-7218
    41Plan

    Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 be

    CriticalCVSS 10.0No exploitEPSS 2%

    horde · groupwareSep 13, 2009

  • CVE-2003-0025
    38Monitor

    Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possi

    HighCVSS 7.5No exploitEPSS 27%

    horde · impJan 17, 2003

  • CVE-2017-9774
    36Monitor

    Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request.

    HighCVSS 8.8No exploitEPSS 2%

    horde · horde image apiJun 21, 2017

  • CVE-2013-6364
    36Monitor

    Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

    HighCVSS 8.8Proof of conceptEPSS 2%

    horde · groupwareNov 5, 2019

  • CVE-2008-3650
    36Monitor

    Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related

    CriticalCVSS 9.0No exploitEPSS 1%

    horde · groupware webmail editionAug 12, 2008

  • CVE-2019-12095
    35Monitor

    Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmark

    HighCVSS 8.8No exploitEPSS 1%

    horde · groupwareOct 24, 2019

  • CVE-2017-14650
    33Monitor

    A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "con

    HighCVSS 8.1No exploitEPSS 3%

    horde · horde image apiSep 21, 2017

  • CVE-2014-3999
    33Monitor

    The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user

    HighCVSS 8.1No exploitEPSS 2%

    horde · horde ldapApr 10, 2018

  • CVE-2017-15235
    32Monitor

    The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads

    HighCVSS 7.5Proof of conceptEPSS 5%

    horde · groupwareOct 10, 2017

  • CVE-2006-6175
    31Monitor

    Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to inc

    HighCVSS 7.5No exploitEPSS 2%

    horde · kronolithNov 30, 2006

  • CVE-2001-1257
    31Monitor

    Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbit

    HighCVSS 7.5No exploitEPSS 1%

    horde · impJul 21, 2001

  • CVE-2002-0181
    31Monitor

    Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and

    HighCVSS 7.5No exploitEPSS 1%

    horde · hordeApr 22, 2002

  • CVE-2017-7414
    30Monitor

    In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has P

    HighCVSS 7.5No exploitEPSS 1%

    horde · groupwareApr 4, 2017

  • CVE-2020-8866
    29Monitor

    This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22.

    MediumCVSS 6.5Proof of conceptEPSS 9%

    horde · groupwareMar 23, 2020

  • CVE-2007-1474
    29Monitor

    Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows l

    MediumCVSS 6.8Proof of conceptEPSS 5%

    horde · horde application frameworkMar 16, 2007

  • CVE-2015-7984
    28Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail

    MediumCVSS 6.8Proof of conceptEPSS 4%

    horde · groupwareNov 19, 2015