Horde have acknowledged multiple vulnerabilities in Horde Groupware Webmail Edition, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerabilities are caused due to the application bundling vulnerable versions of Kronolith and IMP.

For more information:
SA49042
SA49147

The vulnerabilities are reported in versions prior to 4.0.8.

Solution
Update to version 4.0.8.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://lists.horde.org/archives/announce/2012/000773.html
https://github.com/horde/horde/blob/d5ab4aa1734f63c7a27b3b91c8895d55d793200f/bundles/webmail/docs/CHANGES

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers