GCVE - cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:horde:groupware:4.0.1:*:webamail:*:*:*:*:*

part: a version: 4.0.1 update: *

Vendor	Horde (`11d5bec1-2c1f-5ad3-b7a5-41ab167a139d`)
Product	Groupware (`633220d8-04a4-56b2-860e-308bd10f4d89`)
Edition	webamail
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/horde/webmail`	purl2cpe	2026-06-01 10:15:53.878735

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-6640`	vulnerable	2026-06-08 05:03:01.366539	Details available Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565. Published: 2014-04-05T21:00:00.000Z Updated: 2024-09-16T17:14:04.724Z Open on db.gcve.eu Reference links http://lists.horde.org/archives/announce/2012/000775.html https://github.com/horde/horde/commit/08c699f744b6d2be1a5f3a2ba7203f4631b4c5dc http://lists.horde.org/archives/announce/2012/000840.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5567`	vulnerable	2026-06-08 05:02:57.320127	Details available Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafted event location parameters in the (1) month, (2) monthlist, or (3) prevmonthlist fields, related to portal blocks. Published: 2014-04-05T21:00:00.000Z Updated: 2024-08-06T21:14:15.603Z Open on db.gcve.eu Reference links https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html http://www.openwall.com/lists/oss-security/2012/11/23/3 http://www.openwall.com/lists/oss-security/2012/11/23/7 http://secunia.com/advisories/51233	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5566`	vulnerable	2026-06-08 05:02:57.319264	Details available Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the (1) tasks view or (2) search view. Published: 2014-04-05T21:00:00.000Z Updated: 2024-08-06T21:14:15.683Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2012-12/msg00019.html http://bugs.horde.org/ticket/11189 http://www.osvdb.org/82382 http://lists.horde.org/archives/announce/2012/000773.html http://www.openwall.com/lists/oss-security/2012/11/23/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5565`	vulnerable	2026-06-08 05:02:57.304162	Details available Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view. Published: 2014-04-05T21:00:00.000Z Updated: 2024-08-06T21:14:15.432Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2012-12/msg00020.html http://lists.horde.org/archives/announce/2012/000833.html https://github.com/horde/horde/commit/1550c6ecd7204f9579fcbb09ec7089e01b0771e2 http://www.openwall.com/lists/oss-security/2012/11/23/6 http://lists.horde.org/archives/announce/2012/000840.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.