CVE ID:	CVE-2005-4190
Description:	Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Test IDs:	1.3.6.1.4.1.25623.1.0.56010   1.3.6.1.4.1.25623.1.0.56580
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2005-4190 BugTraq ID: 15802 http://www.securityfocus.com/bid/15802 BugTraq ID: 15803 http://www.securityfocus.com/bid/15803 BugTraq ID: 15804 http://www.securityfocus.com/bid/15804 BugTraq ID: 15806 http://www.securityfocus.com/bid/15806 BugTraq ID: 15808 http://www.securityfocus.com/bid/15808 BugTraq ID: 15810 http://www.securityfocus.com/bid/15810 Debian Security Information: DSA-1033 (Google Search) http://www.debian.org/security/2006/dsa-1033 http://www.sec-consult.com/245.html http://lists.horde.org/archives/announce/2005/000238.html http://secunia.com/advisories/17970 http://secunia.com/advisories/19619 http://secunia.com/advisories/19897 http://secunia.com/advisories/20960 SuSE Security Announcement: SUSE-SR:2006:009 (Google Search) http://www.novell.com/linux/security/advisories/2006_04_28.html SuSE Security Announcement: SUSE-SR:2006:016 (Google Search) http://www.novell.com/linux/security/advisories/2006_16_sr.html http://www.vupen.com/english/advisories/2005/2835