This script is Copyright (C) 2007-2014 Tenable Network Security, Inc.
The remote openSUSE host is missing a security update.
This update fixes the following two security issues in the Horde
Application Framework :
- CVE-2006-3548: Multiple cross-site scripting (XSS)
vulnerabilities allow remote attackers to inject
an external (2) http, (3) https, or (4) ftp URI in the
url parameter in services/go.php (aka the dereferrer),
services/help (aka the help viewer), and (6) the name
parameter in services/problem.php (aka the problem
- CVE-2006-3549: services/go.php does not properly
restrict its image proxy capability, which allows remote
attackers to perform 'Web tunneling' attacks and use the
server as a proxy via (1) http, (2) https, and (3) ftp
URL in the url parameter, which is requested from the
Update the affected horde package.
Risk factor :
Medium / CVSS Base Score : 5.0