GCVE - cpe:2.3:a:horde:horde_application_framework:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:horde:horde_application_framework:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Horde (`11d5bec1-2c1f-5ad3-b7a5-41ab167a139d`)
Product	Horde Application Framework (`b4d3c601-9c2a-561a-a05d-ead8a988ea20`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/horde/base`	purl2cpe	2026-06-01 10:15:53.141547

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-7984`	vulnerable	2026-06-08 05:07:02.724444	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php. Published: 2015-11-19T20:00:00.000Z Updated: 2024-08-06T08:06:31.501Z Open on db.gcve.eu Reference links http://lists.horde.org/archives/announce/2015/001124.html http://lists.horde.org/archives/announce/2015/001138.html https://www.exploit-db.com/exploits/38765/ http://www.debian.org/security/2015/dsa-3391 http://lists.horde.org/archives/announce/2015/001137.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1691`	vulnerable	2026-06-08 05:05:25.925018	Details available The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form. Published: 2014-04-01T15:00:00.000Z Updated: 2024-08-06T09:50:10.620Z Open on db.gcve.eu Reference links https://github.com/horde/horde/blob/82c400788537cfc0106b68447789ff53793ac086/bundles/groupware/docs/CHANGES#L215 http://seclists.org/oss-sec/2014/q1/156 http://seclists.org/oss-sec/2014/q1/153 http://seclists.org/oss-sec/2014/q1/169 http://www.debian.org/security/2014/dsa-2853	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3694`	vulnerable	2026-06-08 04:55:16.371135	Details available Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form. Published: 2010-11-09T20:00:00.000Z Updated: 2024-08-07T03:18:52.139Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=630687 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050423.html http://secunia.com/advisories/42140 http://lists.horde.org/archives/announce/2010/000557.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3077`	vulnerable	2026-06-08 04:55:12.522531	Details available Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML via the subdir parameter. Published: 2010-11-09T20:00:00.000Z Updated: 2024-08-07T02:55:46.720Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=630687 http://seclists.org/fulldisclosure/2010/Sep/82 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html http://git.horde.org/diff.php/horde/util/icon_browser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050423.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.