GCVE - cpe:2.3:a:horde:groupware:5.1.2:*:*:*:webmail:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:horde:groupware:5.1.2:*:*:*:webmail:*:*:*

part: a version: 5.1.2 update: *

Vendor	Horde (`11d5bec1-2c1f-5ad3-b7a5-41ab167a139d`)
Product	Groupware (`633220d8-04a4-56b2-860e-308bd10f4d89`)
Edition	*
Language	*
Software edition	webmail
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/horde/webmail`	purl2cpe	2026-06-01 10:15:53.894285

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7414`	vulnerable	2026-06-08 05:09:55.872407	Details available In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it. Published: 2017-04-04T14:00:00.000Z Updated: 2024-08-05T16:04:11.218Z Open on db.gcve.eu Reference links https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4946`	vulnerable	2026-06-08 05:05:46.479369	Details available Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view. Published: 2014-07-14T14:00:00.000Z Updated: 2024-09-17T03:03:19.100Z Open on db.gcve.eu Reference links http://secunia.com/advisories/59772 http://lists.horde.org/archives/announce/2014/001025.html http://secunia.com/advisories/59770 https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4945`	vulnerable	2026-06-08 05:05:46.465906	Details available Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view. Published: 2014-07-14T14:00:00.000Z Updated: 2024-09-17T04:14:56.484Z Open on db.gcve.eu Reference links http://secunia.com/advisories/59772 http://lists.horde.org/archives/announce/2014/001025.html http://secunia.com/advisories/59770 https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6365`	vulnerable	2026-06-08 05:04:56.065975	Details available Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions Published: 2019-11-05T13:53:25.000Z Updated: 2024-08-06T17:39:01.220Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2013-6365 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6365 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6365 http://archives.neohapsis.com/archives/bugtraq/2013-11/0013.html https://www.securityfocus.com/archive/1/529590	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6364`	vulnerable	2026-06-08 05:04:56.065417	Details available Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book Published: 2019-11-05T13:43:51.000Z Updated: 2024-08-06T17:39:00.998Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2013-6364 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6364 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6364 http://archives.neohapsis.com/archives/bugtraq/2013-11/0012.html http://www.exploit-db.com/exploits/29519	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.