Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
**Version 4.4.24** (2021-05-19) * security **CVE-2021-21424** [SecurityCore] Fix user enumeration via response body on invalid credentials (chalasr) * bug #412…
**Version 3.4.49** (2021-05-19) * security **CVE-2021-21424** [SecurityCore] Fix user enumeration via response body on invalid credentials (chalasr) ---- **Ver…
**Version 6.4.1** (April 29th, 2021) * **SECURITY** Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md …
An update that solves two vulnerabilities and has one errata is now available.
An update that solves two vulnerabilities and has one errata is now available.
**Version 4.4.13** (2020-09-02) * security **CVE-2020-15094** Remove headers with internal meaning from HttpClient responses (mpdude) * bug #38024 [Console] Fi…
An update that fixes one vulnerability is now available.
An update that fixes one vulnerability is now available.
The File Manager (gollem) module in Horde Groupware has allowed remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter t…
In Horde Groupware, there has been an XSS vulnerability that could be exploited via the URL field in a "Calendar New Event" action. For Debian 9 stretch, this …
In Horde Groupware, there has been an XSS via the Name field during creation of a new Resource. This could have been leveraged for remote code execution after …
In Horde Groupware, there has been an XSS vulnerability in two components via the Color field in a Create Task List action. For Debian 9 stretch, this problem …
In Horde Groupware, there has been an XSS vulnerability in two components via the Color field in a Create Task List action. For Debian 9 stretch, this problem …
Fix insufficient output escaping bug in file attachment names (CVE-2020-13625). References: - https://bugs.mageia.org/show_bug.cgi?id=26760
**kronolith 4.2.29** * [mjr] Fix regresssion in event modification notifications (Bug #15022). ---- **kronolith 4.2.28** * [mjr] **SECURITY**: Don't leak priva…
**kronolith 4.2.29** * [mjr] Fix regresssion in event modification notifications (Bug #15022). ---- **kronolith 4.2.28** * [mjr] **SECURITY**: Don't leak priva…
Fix CVE-2020-13625 vulnerability.
Fix CVE-2020-13625 vulnerability.
**horde 5.2.23** * [mjr] SECURITY: Fix javascript injection vulnerability in mobile login page. * [mjr] Fix broken cloud search in portal block.
**horde 5.2.23** * [mjr] SECURITY: Fix javascript injection vulnerability in mobile login page. * [mjr] Fix broken cloud search in portal block.
This is a security release, with some other minor changes. For full details, refer to the [advisory](https://github.com/PHPMailer/PHPMailer/security/advisories…
This is a security release, with some other minor changes. For full details, refer to the [advisory](https://github.com/PHPMailer/PHPMailer/security/advisories…
An update that fixes three vulnerabilities is now available.
The image view functionality in Horde Groupware Webmail Edition was affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload conta…
