Unscored severity · published Dec 13, 2005
CVE-2005-4189
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KH
Kronolith H3 · Horde
2.0; 2.0.1; 2.0.2; 2.0.2_rc1; 2.0.3; 2.0.3_rc1; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4189
Vendor Advisory
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0459.html
Patch
http://lists.horde.org/archives/announce/2005/000234.html
Patch
http://secunia.com/advisories/17971
secunia.com
http://secunia.com/advisories/18827
www.debian.org
http://www.debian.org/security/2006/dsa-970
Patch
http://www.osvdb.org/21608
More from Kronolith H3
–
CVE-2008-7219
Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0…
–
CVE-2008-7218
Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before…