CVE-2005-4191 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist’s name or (2) description when creating a new tasklist.

Reference

http://cvs.horde.org/diff.php/nag/templates/tasklists/tasklists.inc?r1=1.10&r2=1.11&ty=h http://lists.horde.org/archives/announce/2005/000236.html http://secunia.com/advisories/17969 http://www.sec-consult.com/245.html http://www.securityfocus.com/bid/15804 http://www.vupen.com/english/advisories/2005/2836