CVE-2013-6364

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-11/0012.htmlBroken Link
http://www.exploit-db.com/exploits/29519Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6364Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6364Issue Tracking
https://security-tracker.debian.org/tracker/CVE-2013-6364Third Party Advisory
https://www.securityfocus.com/archive/1/529589Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-11/0012.htmlBroken Link
http://www.exploit-db.com/exploits/29519Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6364Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6364Issue Tracking
https://security-tracker.debian.org/tracker/CVE-2013-6364Third Party Advisory
https://www.securityfocus.com/archive/1/529589Third Party Advisory, VDB Entry

Timeline

Published: Nov 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-63655.3Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions CVE-2013-63666.5The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getR CVE-2013-63675.7The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a CVE-2013-63686.2The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a CVE-2013-63696.8Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of CVE-2013-63705.0Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2013-63715.0The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted J CVE-2013-63722.1The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH CVE-2013-63735.5The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to l CVE-2013-63743.5Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to CVE-2013-63757.9Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table e CVE-2013-63765.2The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to c