CVE-2008-1284

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 11, 2008
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2008

CVE-2008-12854.3Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web scCVE-2008-12867.8Unspecified vulnerability in Sun Java Web Console 3.0.2, 3.0.3, and 3.0.4 allows remote attackers to bypass intended access restrictions andCVE-2008-12875.0IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which CVE-2008-12885.0IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading useCVE-2008-12897.5Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business EditiCVE-2008-12904.3ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attaCVE-2008-12914.3ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read CVE-2008-12924.3ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtaiCVE-2008-12934.8ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackCVE-2008-12942.1Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is CVE-2008-12956.8SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attCVE-2008-12964.3Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML vi
CVE-2008-1284: Medium severity, CVSS 6.0 | Vulnix