Horde Turba is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user other attacks are also possible. Horde 3.1.7, 3.2, and prior versions are vulnerable.

• http://www.securityfocus.com/bid/29745

---

Updated on 2015-03-25