Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Horde IMP邮件附件HTML注入漏洞
Vulnerability Description
IMP是一款基于Web的强大的邮件程序，它由Horde项目组开发。可使用在Linux/Unix或者Microsoft Windows操作系统下。 Horde IMP在处理文件中的HTML标签时存在漏洞，远程攻击者可能在服务器上执行恶意代码。 Horde IMP在实施安全策略时会删除可能有害的HTML标签。在打印附件文件前，Horde会试图删除<script>、<link>之类的标签。但如果攻击者创建如下的标签的话： <s0x00hcript>alert('HORDE')</s0x00hcript> 0x0
CVSS Information
N/A
Vulnerability Type
N/A