This script is Copyright (C) 2006-2016 Tenable Network Security, Inc.
The remote web server contains a PHP script that is affected by
multiple cross-site scripting vulnerabilities.
The version of Horde installed on the remote host fails to validate
input to the 'url' parameter of the 'services/go.php' script before
using it in dynamically-generated content. An unauthenticated
attacker may be able to leverage this issue to inject arbitrary HTML
and script code into a user's browser.
In addition, similar cross-site scripting issues reportedly exist with
the 'module' parameter of the 'services/help/index.php' script and the
'name' parameter of the 'services/problem.php' script.
See also :
Upgrade to Horde 3.0.11 / 3.1.2 or later.
Risk factor :
Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.7
Public Exploit Available : true
Family: CGI abuses : XSS
Nessus Plugin ID: 22004 (horde_url_xss.nasl)
Bugtraq ID: 18845
CVE ID: CVE-2006-3548CVE-2006-3549
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.