CVE-2005-4189

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.

References

http://www.vupen.com/english/advisories/2005/2834

http://www.securityfocus.com/bid/15808

http://www.sec-consult.com/245.html

http://www.osvdb.org/21611

http://www.osvdb.org/21610

http://www.osvdb.org/21609

http://www.osvdb.org/21608

http://www.debian.org/security/2006/dsa-970

http://secunia.com/advisories/18827

http://secunia.com/advisories/17971

http://lists.horde.org/archives/announce/2005/000234.html

http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0459.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3