📦

imp

Vendor: horde

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 4 Code Available
Total RCEs 0 Remote Access
Total CVEs 273 Total Indexed
Avg. EPSS 2.98% Exploit Prob.
Latest CVE CVE-2012-6640 Apr 05

Security Vulnerability Index

Page 2 / 28
4.3 CVSS
CVE-2005-4080
Exploit Found

Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.

EPSS: 2.40%
4.3 CVSS
CVE-2005-1319

Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.

EPSS: 1.23%
4.3 CVSS
CVE-2004-1443

Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used with Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via an e-mail message.

EPSS: 1.21%
6.8 CVSS
CVE-2004-0584

Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message, possibly triggering a cross-site scripting (XSS) vulnerability.

EPSS: 1.34%
7.5 CVSS
CVE-2003-0025

Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.

EPSS: 27.97%
5.3 CVSS
CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.

EPSS: 1.92%
7.5 CVSS
CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.

EPSS: 1.85%
2.1 CVSS
CVE-2001-0744

Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file.

EPSS: 0.36%
7.5 CVSS
CVE-2001-1257

Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email.

EPSS: 1.97%
3.6 CVSS
CVE-2001-1258

Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.

EPSS: 0.46%