All the vulnerabilites related to roundcube - webmail
cve-2009-4077
Vulnerability from cvelistv5
Published
2009-11-25 21:22
Modified
2024-09-16 17:54
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/wiki/Changelog | x_refsource_MISC | |
| http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html | third-party-advisory, x_refsource_JVNDB | |
| http://www.osvdb.org/59661 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/37235 | third-party-advisory, x_refsource_SECUNIA | |
| http://jvn.jp/en/jp/JVN75694913/index.html | third-party-advisory, x_refsource_JVN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:08.607Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVNDB-2009-000072",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html"
},
{
"name": "59661",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVN#75694913",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN75694913/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-11-25T21:22:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVNDB-2009-000072",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html"
},
{
"name": "59661",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVN#75694913",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN75694913/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4077",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/wiki/Changelog",
"refsource": "MISC",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVNDB-2009-000072",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html"
},
{
"name": "59661",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVN#75694913",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN75694913/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4077",
"datePublished": "2009-11-25T21:22:00Z",
"dateReserved": "2009-11-25T00:00:00Z",
"dateUpdated": "2024-09-16T17:54:25.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-17688
Vulnerability from cvelistv5
Published
2018-05-16 19:00
Modified
2024-08-05 20:59
Severity ?
EPSS score ?
Summary
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
References
| ▼ | URL | Tags |
|---|---|---|
| https://protonmail.com/blog/pgp-vulnerability-efail | x_refsource_MISC | |
| https://news.ycombinator.com/item?id=17066419 | x_refsource_MISC | |
| https://www.patreon.com/posts/cybersecurity-15-18814817 | x_refsource_MISC | |
| http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html | x_refsource_MISC | |
| http://www.securityfocus.com/bid/104162 | vdb-entry, x_refsource_BID | |
| https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html | x_refsource_MISC | |
| https://efail.de | x_refsource_MISC | |
| https://twitter.com/matthew_d_green/status/995996706457243648 | x_refsource_MISC | |
| https://www.synology.com/support/security/Synology_SA_18_22 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1040904 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:59:17.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"name": "104162",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/104162"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://efail.de"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_22"
},
{
"name": "1040904",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1040904"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-17T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"name": "104162",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/104162"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://efail.de"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_22"
},
{
"name": "1040904",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1040904"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17688",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://protonmail.com/blog/pgp-vulnerability-efail",
"refsource": "MISC",
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"name": "https://news.ycombinator.com/item?id=17066419",
"refsource": "MISC",
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"name": "https://www.patreon.com/posts/cybersecurity-15-18814817",
"refsource": "MISC",
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"name": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html",
"refsource": "MISC",
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"name": "104162",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/104162"
},
{
"name": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html",
"refsource": "MISC",
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html"
},
{
"name": "https://efail.de",
"refsource": "MISC",
"url": "https://efail.de"
},
{
"name": "https://twitter.com/matthew_d_green/status/995996706457243648",
"refsource": "MISC",
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_18_22",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_18_22"
},
{
"name": "1040904",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1040904"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17688",
"datePublished": "2018-05-16T19:00:00",
"dateReserved": "2017-12-15T00:00:00",
"dateUpdated": "2024-08-05T20:59:17.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-15562
Vulnerability from cvelistv5
Published
2020-07-06 11:26
Modified
2024-08-04 13:22
Severity ?
EPSS score ?
Summary
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.7 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.14 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.2.11 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82 | x_refsource_MISC | |
| https://www.debian.org/security/2020/dsa-4720 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:22:29.362Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82"
},
{
"name": "DSA-4720",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4720"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82"
},
{
"name": "DSA-4720",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4720"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-15562",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82"
},
{
"name": "DSA-4720",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4720"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-15562",
"datePublished": "2020-07-06T11:26:09",
"dateReserved": "2020-07-06T00:00:00",
"dateUpdated": "2024-08-04T13:22:29.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-1253
Vulnerability from cvelistv5
Published
2012-06-04 15:00
Modified
2024-09-16 19:01
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
References
| ▼ | URL | Tags |
|---|---|---|
| http://jvn.jp/en/jp/JVN21422837/index.html | third-party-advisory, x_refsource_JVN | |
| http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050 | third-party-advisory, x_refsource_JVNDB | |
| http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:53:36.422Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#21422837",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN21422837/index.html"
},
{
"name": "JVNDB-2012-000050",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-06-04T15:00:00Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#21422837",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN21422837/index.html"
},
{
"name": "JVNDB-2012-000050",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2012-1253",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#21422837",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN21422837/index.html"
},
{
"name": "JVNDB-2012-000050",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050"
},
{
"name": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2012-1253",
"datePublished": "2012-06-04T15:00:00Z",
"dateReserved": "2012-02-21T00:00:00Z",
"dateUpdated": "2024-09-16T19:01:14.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-6121
Vulnerability from cvelistv5
Published
2013-02-24 21:00
Modified
2024-08-06 21:28
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html | vendor-advisory, x_refsource_SUSE | |
| http://sourceforge.net/news/?group_id=139281&id=310213 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/57849 | vdb-entry, x_refsource_BID | |
| http://www.openwall.com/lists/oss-security/2013/02/08/1 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/ticket/1488850 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:28:39.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2013:0307",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba"
},
{
"name": "openSUSE-SU-2013:1420",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=310213"
},
{
"name": "57849",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57849"
},
{
"name": "[oss-security] 20130207 Re: CVE request: XSS in roundcube before 0.8.5",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/08/1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488850"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-12-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-03-08T10:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "openSUSE-SU-2013:0307",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba"
},
{
"name": "openSUSE-SU-2013:1420",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=310213"
},
{
"name": "57849",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57849"
},
{
"name": "[oss-security] 20130207 Re: CVE request: XSS in roundcube before 0.8.5",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/08/1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488850"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-6121",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2013:0307",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba"
},
{
"name": "openSUSE-SU-2013:1420",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"name": "http://sourceforge.net/news/?group_id=139281\u0026id=310213",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=310213"
},
{
"name": "57849",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/57849"
},
{
"name": "[oss-security] 20130207 Re: CVE request: XSS in roundcube before 0.8.5",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/02/08/1"
},
{
"name": "http://trac.roundcube.net/ticket/1488850",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1488850"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6121",
"datePublished": "2013-02-24T21:00:00",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T21:28:39.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8114
Vulnerability from cvelistv5
Published
2017-04-29 19:00
Modified
2024-08-05 16:27
Severity ?
EPSS score ?
Summary
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
References
| ▼ | URL | Tags |
|---|---|---|
| https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 | x_refsource_MISC | |
| https://security.gentoo.org/glsa/201707-11 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/98445 | vdb-entry, x_refsource_BID | |
| https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:27:22.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11"
},
{
"name": "GLSA-201707-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201707-11"
},
{
"name": "98445",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98445"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-04-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11"
},
{
"name": "GLSA-201707-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201707-11"
},
{
"name": "98445",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98445"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8114",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11",
"refsource": "MISC",
"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11"
},
{
"name": "GLSA-201707-11",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201707-11"
},
{
"name": "98445",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98445"
},
{
"name": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114",
"refsource": "MISC",
"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8114",
"datePublished": "2017-04-29T19:00:00",
"dateReserved": "2017-04-25T00:00:00",
"dateUpdated": "2024-08-05T16:27:22.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-12625
Vulnerability from cvelistv5
Published
2020-05-04 01:57
Modified
2024-08-04 12:04
Severity ?
EPSS score ?
Summary
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 | x_refsource_MISC | |
| https://www.debian.org/security/2020/dsa-4674 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube | x_refsource_MISC | |
| https://security.gentoo.org/glsa/202007-41 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:04:22.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "DSA-4674",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "DSA-4674",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12625",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "DSA-4674",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"name": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube",
"refsource": "MISC",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube"
},
{
"name": "GLSA-202007-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12625",
"datePublished": "2020-05-04T01:57:31",
"dateReserved": "2020-05-04T00:00:00",
"dateUpdated": "2024-08-04T12:04:22.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-8793
Vulnerability from cvelistv5
Published
2016-01-29 19:00
Modified
2024-09-16 16:57
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
References
| ▼ | URL | Tags |
|---|---|---|
| https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ | x_refsource_CONFIRM | |
| http://trac.roundcube.net/ticket/1490417 | x_refsource_CONFIRM | |
| http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:22.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-01-29T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8793",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"name": "http://trac.roundcube.net/ticket/1490417",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"name": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8793",
"datePublished": "2016-01-29T19:00:00Z",
"dateReserved": "2016-01-29T00:00:00Z",
"dateUpdated": "2024-09-16T16:57:47.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-13965
Vulnerability from cvelistv5
Published
2020-06-09 02:45
Modified
2024-08-04 12:32
Severity ?
EPSS score ?
Summary
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.3.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:1.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.4.5",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-13965",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T15:33:41.762093Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-06-26",
"reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T16:20:22.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-26T00:00:00+00:00",
"value": "CVE-2020-13965 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:32:14.640Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-21T13:57:32",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13965",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5"
},
{
"name": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"name": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube",
"refsource": "MISC",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13965",
"datePublished": "2020-06-09T02:45:24",
"dateReserved": "2020-06-09T00:00:00",
"dateUpdated": "2024-08-04T12:32:14.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-4076
Vulnerability from cvelistv5
Published
2009-11-25 21:22
Modified
2024-09-16 23:46
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/wiki/Changelog | x_refsource_MISC | |
| http://jvn.jp/en/jp/JVN72974205/index.html | third-party-advisory, x_refsource_JVN | |
| http://www.osvdb.org/59661 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/37235 | third-party-advisory, x_refsource_SECUNIA | |
| http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html | third-party-advisory, x_refsource_JVNDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:08.626Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVN#72974205",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN72974205/index.html"
},
{
"name": "59661",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVNDB-2009-000071",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-11-25T21:22:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVN#72974205",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN72974205/index.html"
},
{
"name": "59661",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVNDB-2009-000071",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4076",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/wiki/Changelog",
"refsource": "MISC",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "JVN#72974205",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN72974205/index.html"
},
{
"name": "59661",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/59661"
},
{
"name": "37235",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37235"
},
{
"name": "JVNDB-2009-000071",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4076",
"datePublished": "2009-11-25T21:22:00Z",
"dateReserved": "2009-11-25T00:00:00Z",
"dateUpdated": "2024-09-16T23:46:21.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-42009
Vulnerability from cvelistv5
Published
2024-08-05 00:00
Modified
2024-08-06 20:24
Severity ?
EPSS score ?
Summary
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:24:03.927917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T20:24:27.258Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T19:07:08.180456",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases"
},
{
"url": "https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.8"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.8"
},
{
"url": "https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-42009",
"datePublished": "2024-08-05T00:00:00",
"dateReserved": "2024-07-26T00:00:00",
"dateUpdated": "2024-08-06T20:24:27.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-12640
Vulnerability from cvelistv5
Published
2020-05-04 14:58
Modified
2024-08-04 12:04
Severity ?
EPSS score ?
Summary
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 | x_refsource_MISC | |
| https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794 | x_refsource_MISC | |
| https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube | x_refsource_MISC | |
| https://security.gentoo.org/glsa/202007-41 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:04:22.314Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12640",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10",
"refsource": "MISC",
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794"
},
{
"name": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube",
"refsource": "MISC",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube"
},
{
"name": "GLSA-202007-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12640",
"datePublished": "2020-05-04T14:58:28",
"dateReserved": "2020-05-04T00:00:00",
"dateUpdated": "2024-08-04T12:04:22.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-1492
Vulnerability from cvelistv5
Published
2011-04-08 15:00
Modified
2024-08-06 22:28
Severity ?
EPSS score ?
Summary
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://openwall.com/lists/oss-security/2011/03/24/3 | mailing-list, x_refsource_MLIST | |
| http://secunia.com/advisories/44050 | third-party-advisory, x_refsource_SECUNIA | |
| http://openwall.com/lists/oss-security/2011/03/24/4 | mailing-list, x_refsource_MLIST | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/66613 | vdb-entry, x_refsource_XF | |
| http://openwall.com/lists/oss-security/2011/04/04/50 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/wiki/Changelog | x_refsource_CONFIRM | |
| http://trac.roundcube.net/changeset/4488 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:28:41.631Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110324 CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"name": "44050",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/44050"
},
{
"name": "[oss-security] 20110324 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"name": "roundcube-modcss-security-bypass(66613)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66613"
},
{
"name": "[oss-security] 20110404 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/4488"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20110324 CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"name": "44050",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/44050"
},
{
"name": "[oss-security] 20110324 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"name": "roundcube-modcss-security-bypass(66613)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66613"
},
{
"name": "[oss-security] 20110404 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/4488"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1492",
"datePublished": "2011-04-08T15:00:00",
"dateReserved": "2011-03-21T00:00:00",
"dateUpdated": "2024-08-06T22:28:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-5382
Vulnerability from cvelistv5
Published
2017-05-23 03:56
Modified
2024-08-06 06:50
Severity ?
EPSS score ?
Summary
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-list, x_refsource_MLIST | |
| https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4817 | x_refsource_CONFIRM | |
| https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2015/07/07/3 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5382",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4817",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5382",
"datePublished": "2017-05-23T03:56:00",
"dateReserved": "2015-07-06T00:00:00",
"dateUpdated": "2024-08-06T06:50:00.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-12626
Vulnerability from cvelistv5
Published
2020-05-04 01:57
Modified
2024-08-04 12:04
Severity ?
EPSS score ?
Summary
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/pull/7302 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6 | x_refsource_MISC | |
| https://www.debian.org/security/2020/dsa-4674 | vendor-advisory, x_refsource_DEBIAN | |
| https://security.gentoo.org/glsa/202007-41 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:04:22.307Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/pull/7302"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6"
},
{
"name": "DSA-4674",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-41"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-27T02:06:24",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/pull/7302"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6"
},
{
"name": "DSA-4674",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202007-41"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12626",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "https://github.com/roundcube/roundcubemail/pull/7302",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/pull/7302"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6"
},
{
"name": "DSA-4674",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"name": "GLSA-202007-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-41"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12626",
"datePublished": "2020-05-04T01:57:17",
"dateReserved": "2020-05-04T00:00:00",
"dateUpdated": "2024-08-04T12:04:22.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-2180
Vulnerability from cvelistv5
Published
2017-01-30 22:00
Modified
2024-08-06 05:10
Severity ?
EPSS score ?
Summary
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/96387 | vdb-entry, x_refsource_BID | |
| https://github.com/roundcube/roundcubemail/issues/4757 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:10:15.948Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96387",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96387"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96387",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96387"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2180",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96387",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96387"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4757",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2180",
"datePublished": "2017-01-30T22:00:00",
"dateReserved": "2015-03-02T00:00:00",
"dateUpdated": "2024-08-06T05:10:15.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-5381
Vulnerability from cvelistv5
Published
2017-05-23 03:56
Modified
2024-08-06 06:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/ticket/1490417 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4837 | x_refsource_CONFIRM | |
| https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "http://trac.roundcube.net/ticket/1490417",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4837",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5381",
"datePublished": "2017-05-23T03:56:00",
"dateReserved": "2015-07-06T00:00:00",
"dateUpdated": "2024-08-06T06:50:00.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-0464
Vulnerability from cvelistv5
Published
2010-01-29 18:00
Modified
2024-08-07 00:52
Severity ?
EPSS score ?
Summary
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2010:048 | vendor-advisory, x_refsource_MANDRIVA | |
| https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail | x_refsource_MISC | |
| http://trac.roundcube.net/ticket/1486449 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:52:18.644Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2010:048",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:048"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1486449"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-03-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2010:048",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:048"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1486449"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-0464",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2010:048",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:048"
},
{
"name": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail",
"refsource": "MISC",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"name": "http://trac.roundcube.net/ticket/1486449",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1486449"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-0464",
"datePublished": "2010-01-29T18:00:00",
"dateReserved": "2010-01-29T00:00:00",
"dateUpdated": "2024-08-07T00:52:18.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-6172
Vulnerability from cvelistv5
Published
2013-11-05 18:00
Modified
2024-08-06 17:29
Severity ?
EPSS score ?
Summary
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/ticket/1489382 | x_refsource_CONFIRM | |
| http://roundcube.net/news/2013/10/21/security-updates-095-and-087/ | x_refsource_CONFIRM | |
| http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2013/dsa-2787 | vendor-advisory, x_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:29:42.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1489382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19"
},
{
"name": "openSUSE-SU-2014:0365",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html"
},
{
"name": "DSA-2787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2787"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-17T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1489382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19"
},
{
"name": "openSUSE-SU-2014:0365",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html"
},
{
"name": "DSA-2787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2787"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6172",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/ticket/1489382",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1489382"
},
{
"name": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/",
"refsource": "CONFIRM",
"url": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/"
},
{
"name": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19",
"refsource": "CONFIRM",
"url": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19"
},
{
"name": "openSUSE-SU-2014:0365",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html"
},
{
"name": "DSA-2787",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2787"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-6172",
"datePublished": "2013-11-05T18:00:00",
"dateReserved": "2013-10-18T00:00:00",
"dateUpdated": "2024-08-06T17:29:42.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-1433
Vulnerability from cvelistv5
Published
2015-02-03 16:00
Modified
2024-08-06 04:40
Severity ?
EPSS score ?
Summary
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/changeset/786aa0725/github | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/72401 | vdb-entry, x_refsource_BID | |
| http://trac.roundcube.net/ticket/1490227 | x_refsource_CONFIRM | |
| http://roundcube.net/news/2015/01/24/security-update-1.0.5/ | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html | vendor-advisory, x_refsource_SUSE | |
| http://www.openwall.com/lists/oss-security/2015/01/31/6 | mailing-list, x_refsource_MLIST | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.openwall.com/lists/oss-security/2015/01/31/3 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:40:18.907Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/786aa0725/github"
},
{
"name": "72401",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/72401"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490227"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"
},
{
"name": "openSUSE-SU-2015:0286",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"
},
{
"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"
},
{
"name": "FEDORA-2015-1772",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"
},
{
"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-01-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-03-19T15:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/786aa0725/github"
},
{
"name": "72401",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/72401"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490227"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"
},
{
"name": "openSUSE-SU-2015:0286",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"
},
{
"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"
},
{
"name": "FEDORA-2015-1772",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"
},
{
"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-1433",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/changeset/786aa0725/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/786aa0725/github"
},
{
"name": "72401",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/72401"
},
{
"name": "http://trac.roundcube.net/ticket/1490227",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490227"
},
{
"name": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/",
"refsource": "CONFIRM",
"url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"
},
{
"name": "openSUSE-SU-2015:0286",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"
},
{
"name": "[oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"
},
{
"name": "FEDORA-2015-1772",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"
},
{
"name": "[oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-1433",
"datePublished": "2015-02-03T16:00:00",
"dateReserved": "2015-01-31T00:00:00",
"dateUpdated": "2024-08-06T04:40:18.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-26925
Vulnerability from cvelistv5
Published
2021-02-09 08:53
Modified
2024-08-03 20:33
Severity ?
EPSS score ?
Summary
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
References
| ▼ | URL | Tags |
|---|---|---|
| https://roundcube.net/news/2021/02/08/security-update-1.4.11 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596 | x_refsource_CONFIRM | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/ | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:33:41.502Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2021/02/08/security-update-1.4.11"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"
},
{
"name": "FEDORA-2021-aef54ec149",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/"
},
{
"name": "FEDORA-2021-434b65378a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-17T06:06:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2021/02/08/security-update-1.4.11"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"
},
{
"name": "FEDORA-2021-aef54ec149",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/"
},
{
"name": "FEDORA-2021-434b65378a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-26925",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2021/02/08/security-update-1.4.11",
"refsource": "MISC",
"url": "https://roundcube.net/news/2021/02/08/security-update-1.4.11"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"
},
{
"name": "FEDORA-2021-aef54ec149",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/"
},
{
"name": "FEDORA-2021-434b65378a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26925",
"datePublished": "2021-02-09T08:53:14",
"dateReserved": "2021-02-09T00:00:00",
"dateUpdated": "2024-08-03T20:33:41.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19205
Vulnerability from cvelistv5
Published
2018-11-12 17:00
Modified
2024-09-16 23:51
Severity ?
EPSS score ?
Summary
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://roundcube.net/news/2018/07/27/update-1.3.7-released | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.7 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:30:04.199Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2018/07/27/update-1.3.7-released"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-12T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2018/07/27/update-1.3.7-released"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19205",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2018/07/27/update-1.3.7-released",
"refsource": "MISC",
"url": "https://roundcube.net/news/2018/07/27/update-1.3.7-released"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19205",
"datePublished": "2018-11-12T17:00:00Z",
"dateReserved": "2018-11-12T00:00:00Z",
"dateUpdated": "2024-09-16T23:51:52.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-35730
Vulnerability from cvelistv5
Published
2020-12-28 19:37
Modified
2024-08-04 17:09
Severity ?
EPSS score ?
Summary
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://roundcube.net/download/ | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10 | x_refsource_CONFIRM | |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491 | x_refsource_CONFIRM | |
| https://www.alexbirnberg.com/roundcube-xss.html | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.16 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.2.13 | x_refsource_CONFIRM | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/ | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.160Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/download/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.alexbirnberg.com/roundcube-xss.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13"
},
{
"name": "FEDORA-2021-2cb0643316",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/"
},
{
"name": "FEDORA-2021-73359af51c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T03:06:08",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/download/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.alexbirnberg.com/roundcube-xss.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13"
},
{
"name": "FEDORA-2021-2cb0643316",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/"
},
{
"name": "FEDORA-2021-73359af51c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-35730",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/download/",
"refsource": "MISC",
"url": "https://roundcube.net/download/"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491",
"refsource": "CONFIRM",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491"
},
{
"name": "https://www.alexbirnberg.com/roundcube-xss.html",
"refsource": "MISC",
"url": "https://www.alexbirnberg.com/roundcube-xss.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13"
},
{
"name": "FEDORA-2021-2cb0643316",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/"
},
{
"name": "FEDORA-2021-73359af51c",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-35730",
"datePublished": "2020-12-28T19:37:08",
"dateReserved": "2020-12-27T00:00:00",
"dateUpdated": "2024-08-04T17:09:15.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-0413
Vulnerability from cvelistv5
Published
2009-02-03 23:00
Modified
2024-08-07 04:31
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/changeset/2245 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2009/0192 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/33372 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/48129 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/33622 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/33827 | third-party-advisory, x_refsource_SECUNIA | |
| https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:31:26.204Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/2245"
},
{
"name": "ADV-2009-0192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0192"
},
{
"name": "33372",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33372"
},
{
"name": "roundcube-html-xss(48129)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48129"
},
{
"name": "33622",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33622"
},
{
"name": "33827",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33827"
},
{
"name": "FEDORA-2009-1256",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/2245"
},
{
"name": "ADV-2009-0192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0192"
},
{
"name": "33372",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33372"
},
{
"name": "roundcube-html-xss(48129)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48129"
},
{
"name": "33622",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33622"
},
{
"name": "33827",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33827"
},
{
"name": "FEDORA-2009-1256",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/changeset/2245",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/2245"
},
{
"name": "ADV-2009-0192",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0192"
},
{
"name": "33372",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33372"
},
{
"name": "roundcube-html-xss(48129)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48129"
},
{
"name": "33622",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33622"
},
{
"name": "33827",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33827"
},
{
"name": "FEDORA-2009-1256",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0413",
"datePublished": "2009-02-03T23:00:00",
"dateReserved": "2009-02-03T00:00:00",
"dateUpdated": "2024-08-07T04:31:26.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-5383
Vulnerability from cvelistv5
Published
2017-05-23 03:56
Modified
2024-08-06 06:50
Severity ?
EPSS score ?
Summary
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-list, x_refsource_MLIST | |
| https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4816 | x_refsource_CONFIRM | |
| https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.802Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5383",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4816",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5383",
"datePublished": "2017-05-23T03:56:00",
"dateReserved": "2015-07-06T00:00:00",
"dateUpdated": "2024-08-06T06:50:00.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-18670
Vulnerability from cvelistv5
Published
2021-06-24 18:07
Modified
2024-08-04 14:00
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/7406 | x_refsource_MISC | |
| https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | x_refsource_MISC | |
| https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:00:49.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-24T18:07:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-18670",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/7406",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"name": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12",
"refsource": "MISC",
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php",
"refsource": "MISC",
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-18670",
"datePublished": "2021-06-24T18:07:54",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:00:49.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-4668
Vulnerability from cvelistv5
Published
2012-08-25 10:00
Modified
2024-09-17 02:10
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/ticket/1488613 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/08/20/9 | mailing-list, x_refsource_MLIST | |
| https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/08/20/2 | mailing-list, x_refsource_MLIST | |
| http://sourceforge.net/news/?group_id=139281&id=309011 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:42:55.001Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-25T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4668",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/ticket/1488613",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"name": "http://sourceforge.net/news/?group_id=139281\u0026id=309011",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4668",
"datePublished": "2012-08-25T10:00:00Z",
"dateReserved": "2012-08-24T00:00:00Z",
"dateUpdated": "2024-09-17T02:10:40.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-10740
Vulnerability from cvelistv5
Published
2019-04-07 14:36
Modified
2024-08-04 22:32
Severity ?
EPSS score ?
Summary
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/6638 | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/ | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:32:01.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6638"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6638"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-10740",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/6638",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/6638"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-10740",
"datePublished": "2019-04-07T14:36:23",
"dateReserved": "2019-04-03T00:00:00",
"dateUpdated": "2024-08-04T22:32:01.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5645
Vulnerability from cvelistv5
Published
2013-08-29 10:00
Modified
2024-08-06 17:15
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github | x_refsource_CONFIRM | |
| http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html | vendor-advisory, x_refsource_SUSE | |
| http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 | x_refsource_CONFIRM | |
| http://trac.roundcube.net/ticket/1489251 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:15:21.493Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github"
},
{
"name": "openSUSE-SU-2013:1420",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1489251"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-09-12T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github"
},
{
"name": "openSUSE-SU-2013:1420",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1489251"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5645",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github"
},
{
"name": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github"
},
{
"name": "openSUSE-SU-2013:1420",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"name": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3"
},
{
"name": "http://trac.roundcube.net/ticket/1489251",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1489251"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5645",
"datePublished": "2013-08-29T10:00:00",
"dateReserved": "2013-08-28T00:00:00",
"dateUpdated": "2024-08-06T17:15:21.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-16145
Vulnerability from cvelistv5
Published
2020-08-12 12:29
Modified
2024-08-04 13:37
Severity ?
EPSS score ?
Summary
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.8 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.15 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070 | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.697Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070"
},
{
"name": "FEDORA-2020-d0f8f20cfc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/"
},
{
"name": "FEDORA-2020-b1e023936e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070"
},
{
"name": "FEDORA-2020-d0f8f20cfc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/"
},
{
"name": "FEDORA-2020-b1e023936e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-16145",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070"
},
{
"name": "FEDORA-2020-d0f8f20cfc",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/"
},
{
"name": "FEDORA-2020-b1e023936e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-16145",
"datePublished": "2020-08-12T12:29:44",
"dateReserved": "2020-07-29T00:00:00",
"dateUpdated": "2024-08-04T13:37:53.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-8105
Vulnerability from cvelistv5
Published
2015-11-10 16:00
Modified
2024-08-06 08:13
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201603-03 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html | vendor-advisory, x_refsource_SUSE | |
| http://trac.roundcube.net/changeset/dd7db2179/github | x_refsource_CONFIRM | |
| http://trac.roundcube.net/ticket/1490530 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:13:30.942Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "openSUSE-SU-2015:1904",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/dd7db2179/github"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490530"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-09-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T15:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "openSUSE-SU-2015:1904",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/dd7db2179/github"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490530"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8105",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201603-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "openSUSE-SU-2015:1904",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html"
},
{
"name": "http://trac.roundcube.net/changeset/dd7db2179/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/dd7db2179/github"
},
{
"name": "http://trac.roundcube.net/ticket/1490530",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490530"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8105",
"datePublished": "2015-11-10T16:00:00",
"dateReserved": "2015-11-10T00:00:00",
"dateUpdated": "2024-08-06T08:13:30.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-2181
Vulnerability from cvelistv5
Published
2017-01-30 22:00
Modified
2024-08-06 05:10
Severity ?
EPSS score ?
Summary
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/96391 | vdb-entry, x_refsource_BID | |
| https://github.com/roundcube/roundcubemail/issues/4757 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:10:16.191Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96391",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96391"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96391",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96391"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2181",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96391",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96391"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4757",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2181",
"datePublished": "2017-01-30T22:00:00",
"dateReserved": "2015-03-02T00:00:00",
"dateUpdated": "2024-08-06T05:10:16.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-5619
Vulnerability from cvelistv5
Published
2008-12-17 02:00
Modified
2024-08-07 10:56
Severity ?
EPSS score ?
Summary
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:56:47.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://mahara.org/interaction/forum/topic.php?id=533"
},
{
"name": "7549",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/7549"
},
{
"name": "7553",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/7553"
},
{
"name": "FEDORA-2008-11234",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html"
},
{
"name": "ADV-2008-3418",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/2148"
},
{
"name": "53893",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/53893"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"name": "34789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34789"
},
{
"name": "ADV-2008-3419",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3419"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1485618"
},
{
"name": "FEDORA-2008-11220",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html"
},
{
"name": "[oss-security] 20081212 CVE Request - roundcubemail",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/12/12/1"
},
{
"name": "33170",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33170"
},
{
"name": "33145",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33145"
},
{
"name": "20081222 POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/499489/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-12-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://mahara.org/interaction/forum/topic.php?id=533"
},
{
"name": "7549",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/7549"
},
{
"name": "7553",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/7553"
},
{
"name": "FEDORA-2008-11234",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html"
},
{
"name": "ADV-2008-3418",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/2148"
},
{
"name": "53893",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/53893"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"name": "34789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34789"
},
{
"name": "ADV-2008-3419",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3419"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trac.roundcube.net/ticket/1485618"
},
{
"name": "FEDORA-2008-11220",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html"
},
{
"name": "[oss-security] 20081212 CVE Request - roundcubemail",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/12/12/1"
},
{
"name": "33170",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33170"
},
{
"name": "33145",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33145"
},
{
"name": "20081222 POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/499489/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-5619",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://mahara.org/interaction/forum/topic.php?id=533",
"refsource": "CONFIRM",
"url": "http://mahara.org/interaction/forum/topic.php?id=533"
},
{
"name": "7549",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/7549"
},
{
"name": "7553",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/7553"
},
{
"name": "FEDORA-2008-11234",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html"
},
{
"name": "ADV-2008-3418",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"name": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a",
"refsource": "CONFIRM",
"url": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a"
},
{
"name": "http://trac.roundcube.net/changeset/2148",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/2148"
},
{
"name": "53893",
"refsource": "OSVDB",
"url": "http://osvdb.org/53893"
},
{
"name": "http://sourceforge.net/forum/forum.php?forum_id=898542",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"name": "34789",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34789"
},
{
"name": "ADV-2008-3419",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3419"
},
{
"name": "http://trac.roundcube.net/ticket/1485618",
"refsource": "MISC",
"url": "http://trac.roundcube.net/ticket/1485618"
},
{
"name": "FEDORA-2008-11220",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html"
},
{
"name": "[oss-security] 20081212 CVE Request - roundcubemail",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/12/12/1"
},
{
"name": "33170",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33170"
},
{
"name": "33145",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33145"
},
{
"name": "20081222 POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/499489/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-5619",
"datePublished": "2008-12-17T02:00:00",
"dateReserved": "2008-12-16T00:00:00",
"dateUpdated": "2024-08-07T10:56:47.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-9587
Vulnerability from cvelistv5
Published
2015-01-15 15:00
Modified
2024-08-06 13:47
Severity ?
EPSS score ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
References
| ▼ | URL | Tags |
|---|---|---|
| http://roundcube.net/news/2014/12/18/update-1.0.4-released/ | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1179780 | x_refsource_CONFIRM | |
| https://bugs.gentoo.org/show_bug.cgi?id=534766 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/71909 | vdb-entry, x_refsource_BID | |
| http://www.openwall.com/lists/oss-security/2015/01/11/3 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:47:41.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766"
},
{
"name": "71909",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71909"
},
{
"name": "[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-01-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-01-15T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766"
},
{
"name": "71909",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71909"
},
{
"name": "[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9587",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/",
"refsource": "CONFIRM",
"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780"
},
{
"name": "https://bugs.gentoo.org/show_bug.cgi?id=534766",
"refsource": "MISC",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766"
},
{
"name": "71909",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71909"
},
{
"name": "[oss-security] 20150111 Re: CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9587",
"datePublished": "2015-01-15T15:00:00",
"dateReserved": "2015-01-11T00:00:00",
"dateUpdated": "2024-08-06T13:47:41.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43770
Vulnerability from cvelistv5
Published
2023-09-22 00:00
Modified
2024-08-02 19:52
Severity ?
EPSS score ?
Summary
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.4.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:1.5.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:1.6.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.6.3",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "debian_linux",
"vendor": "debian",
"versions": [
{
"status": "affected",
"version": "10"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"dateAdded": "2024-02-12",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-43770"
},
"type": "kev"
}
},
{
"other": {
"content": {
"id": "CVE-2023-43770",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-01T18:43:07.516175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:26:02.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2024-02-12T00:00:00+00:00",
"value": "CVE-2023-43770 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:52:11.104Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b"
},
{
"tags": [
"x_transferred"
],
"url": "https://roundcube.net/news/2023/09/15/security-update-1.6.3-released"
},
{
"name": "[debian-lts-announce] 20230922 [SECURITY] [DLA 3577-1] roundcube security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-22T13:06:08.676829",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b"
},
{
"url": "https://roundcube.net/news/2023/09/15/security-update-1.6.3-released"
},
{
"name": "[debian-lts-announce] 20230922 [SECURITY] [DLA 3577-1] roundcube security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43770",
"datePublished": "2023-09-22T00:00:00",
"dateReserved": "2023-09-22T00:00:00",
"dateUpdated": "2024-08-02T19:52:11.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-4069
Vulnerability from cvelistv5
Published
2016-08-25 18:00
Modified
2024-08-06 00:17
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92654 | vdb-entry, x_refsource_BID | |
| https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4957 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html | vendor-advisory, x_refsource_SUSE | |
| http://www.openwall.com/lists/oss-security/2016/04/23/4 | mailing-list, x_refsource_MLIST | |
| https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:17:30.803Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92654",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92654"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4957"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "[oss-security] 20160423 Re: CVE Request: Roundcube: XSS issue in SVG image handling and protection for download urs against CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/04/23/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "92654",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92654"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4957"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "[oss-security] 20160423 Re: CVE Request: Roundcube: XSS issue in SVG image handling and protection for download urs against CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/04/23/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-4069",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92654",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92654"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4957",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4957"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "[oss-security] 20160423 Re: CVE Request: Roundcube: XSS issue in SVG image handling and protection for download urs against CSRF",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/04/23/4"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-4069",
"datePublished": "2016-08-25T18:00:00",
"dateReserved": "2016-04-23T00:00:00",
"dateUpdated": "2024-08-06T00:17:30.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-6321
Vulnerability from cvelistv5
Published
2007-12-12 01:00
Modified
2024-08-07 16:02
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/484802/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/38981 | vdb-entry, x_refsource_XF | |
| http://trac.roundcube.net/ticket/1484701 | x_refsource_CONFIRM | |
| http://securityreason.com/securityalert/3435 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/26800 | vdb-entry, x_refsource_BID | |
| http://openmya.hacker.jp/hasegawa/security/expression.txt | x_refsource_MISC | |
| http://secunia.com/advisories/30734 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:02:36.555Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071209 Unsanitized scripting in RoundCube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/484802/100/0/threaded"
},
{
"name": "roundcube-email-messages-xss(38981)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1484701"
},
{
"name": "3435",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3435"
},
{
"name": "26800",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26800"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://openmya.hacker.jp/hasegawa/security/expression.txt"
},
{
"name": "30734",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30734"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-12-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071209 Unsanitized scripting in RoundCube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/484802/100/0/threaded"
},
{
"name": "roundcube-email-messages-xss(38981)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1484701"
},
{
"name": "3435",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3435"
},
{
"name": "26800",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26800"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://openmya.hacker.jp/hasegawa/security/expression.txt"
},
{
"name": "30734",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30734"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6321",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071209 Unsanitized scripting in RoundCube webmail",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/484802/100/0/threaded"
},
{
"name": "roundcube-email-messages-xss(38981)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38981"
},
{
"name": "http://trac.roundcube.net/ticket/1484701",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1484701"
},
{
"name": "3435",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3435"
},
{
"name": "26800",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26800"
},
{
"name": "http://openmya.hacker.jp/hasegawa/security/expression.txt",
"refsource": "MISC",
"url": "http://openmya.hacker.jp/hasegawa/security/expression.txt"
},
{
"name": "30734",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30734"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6321",
"datePublished": "2007-12-12T01:00:00",
"dateReserved": "2007-12-11T00:00:00",
"dateUpdated": "2024-08-07T16:02:36.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-5631
Vulnerability from cvelistv5
Published
2023-10-18 14:51
Modified
2024-08-02 08:07
Severity ?
EPSS score ?
Summary
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Roundcube | Roundcubemail |
Version: 1.6.0 ≤ Version: 1.5.0 ≤ Version: 1.4.0 ≤ |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:32.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/9168"
},
{
"tags": [
"x_transferred"
],
"url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d"
},
{
"tags": [
"x_transferred"
],
"url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5531"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/1"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/3"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/17/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Roundcubemail",
"repo": "https://github.com/roundcube/roundcubemail",
"vendor": "Roundcube",
"versions": [
{
"lessThan": "1.6.3",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
},
{
"lessThan": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"lessThan": "1.5.14",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.6.4"
},
{
"status": "unaffected",
"version": "1.5.5"
},
{
"status": "unaffected",
"version": "1.5.15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Matthieu Faou"
},
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Denys Klymenko"
},
{
"lang": "en",
"type": "remediation developer",
"user": "00000000-0000-4000-9000-000000000000",
"value": " Aleksander Machniak "
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cdiv\u003eRoundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\n\n"
}
],
"value": "\nRoundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.\n\n\n\n\n\n\n\n"
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nActively used in the wild.\n\n\u003cbr\u003e"
}
],
"value": "\nActively used in the wild.\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-18T14:51:18.443Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15"
},
{
"url": "https://github.com/roundcube/roundcubemail/issues/9168"
},
{
"url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d"
},
{
"url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079"
},
{
"url": "https://www.debian.org/security/2023/dsa-5531"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/3"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/11/17/2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS vulnerability in Roundcube",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2023-5631",
"datePublished": "2023-10-18T14:51:18.443Z",
"dateReserved": "2023-10-18T06:50:57.504Z",
"dateUpdated": "2024-08-02T08:07:32.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6820
Vulnerability from cvelistv5
Published
2017-03-12 04:57
Modified
2024-08-05 15:41
Severity ?
EPSS score ?
Summary
rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124 | x_refsource_CONFIRM | |
| https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.1.8 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.2.4 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/96817 | vdb-entry, x_refsource_BID | |
| https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:41:17.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4"
},
{
"name": "96817",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96817"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-14T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4"
},
{
"name": "96817",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96817"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6820",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124"
},
{
"name": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4"
},
{
"name": "96817",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96817"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6820",
"datePublished": "2017-03-12T04:57:00",
"dateReserved": "2017-03-11T00:00:00",
"dateUpdated": "2024-08-05T15:41:17.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-3507
Vulnerability from cvelistv5
Published
2012-08-25 10:00
Modified
2024-08-06 20:05
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2012/08/20/3 | mailing-list, x_refsource_MLIST | |
| http://www.securelist.com/en/advisories/50212 | x_refsource_MISC | |
| http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/ | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/08/20/9 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2012/08/20/2 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/ticket/1488519 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/50212 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:05:12.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securelist.com/en/advisories/50212"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488519"
},
{
"name": "50212",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50212"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-25T10:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securelist.com/en/advisories/50212"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488519"
},
{
"name": "50212",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50212"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-3507",
"datePublished": "2012-08-25T10:00:00Z",
"dateReserved": "2012-06-14T00:00:00Z",
"dateUpdated": "2024-08-06T20:05:12.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-44026
Vulnerability from cvelistv5
Published
2021-11-19 03:47
Modified
2024-08-04 04:10
Severity ?
EPSS score ?
Summary
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
References
| ▼ | URL | Tags |
|---|---|---|
| https://bugs.debian.org/1000156 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/ | vendor-advisory, x_refsource_FEDORA | |
| https://www.debian.org/security/2021/dsa-5013 | vendor-advisory, x_refsource_DEBIAN | |
| https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:10:17.288Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.debian.org/1000156"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa"
},
{
"name": "FEDORA-2021-167865df98",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-06T21:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.debian.org/1000156"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa"
},
{
"name": "FEDORA-2021-167865df98",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-44026",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.debian.org/1000156",
"refsource": "MISC",
"url": "https://bugs.debian.org/1000156"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa"
},
{
"name": "FEDORA-2021-167865df98",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-44026",
"datePublished": "2021-11-19T03:47:27",
"dateReserved": "2021-11-19T00:00:00",
"dateUpdated": "2024-08-04T04:10:17.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-5620
Vulnerability from cvelistv5
Published
2008-12-17 02:00
Modified
2024-08-07 10:56
Severity ?
EPSS score ?
Summary
RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2008/3418 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/47550 | vdb-entry, x_refsource_XF | |
| http://sourceforge.net/forum/forum.php?forum_id=898542 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:56:47.315Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2008-3418",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"name": "webmail-quota-image-dos(47550)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47550"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-12-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2008-3418",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"name": "webmail-quota-image-dos(47550)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47550"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-5620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2008-3418",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"name": "webmail-quota-image-dos(47550)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47550"
},
{
"name": "http://sourceforge.net/forum/forum.php?forum_id=898542",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-5620",
"datePublished": "2008-12-17T02:00:00",
"dateReserved": "2008-12-16T00:00:00",
"dateUpdated": "2024-08-07T10:56:47.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4078
Vulnerability from cvelistv5
Published
2011-11-03 15:00
Modified
2024-08-06 23:53
Severity ?
EPSS score ?
Summary
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/ticket/1488086 | x_refsource_CONFIRM | |
| http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 | vendor-advisory, x_refsource_HP | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/71025 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/50402 | vdb-entry, x_refsource_BID | |
| http://openwall.com/lists/oss-security/2011/10/26/6 | mailing-list, x_refsource_MLIST | |
| http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 | vendor-advisory, x_refsource_HP |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:32.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488086"
},
{
"name": "HPSBMU02786",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"name": "webmail-uri-dos(71025)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71025"
},
{
"name": "50402",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/50402"
},
{
"name": "[oss-security] 20111026 Re: CVE Request -- Round Cube Webmail -- DoS (unavailability to access user\u0027s INBOX) after receiving an email message with the URL in the Subject",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/10/26/6"
},
{
"name": "SSRT100877",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488086"
},
{
"name": "HPSBMU02786",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"name": "webmail-uri-dos(71025)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71025"
},
{
"name": "50402",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/50402"
},
{
"name": "[oss-security] 20111026 Re: CVE Request -- Round Cube Webmail -- DoS (unavailability to access user\u0027s INBOX) after receiving an email message with the URL in the Subject",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/10/26/6"
},
{
"name": "SSRT100877",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-4078",
"datePublished": "2011-11-03T15:00:00",
"dateReserved": "2011-10-18T00:00:00",
"dateUpdated": "2024-08-06T23:53:32.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-42008
Vulnerability from cvelistv5
Published
2024-08-05 00:00
Modified
2024-08-07 19:58
Severity ?
EPSS score ?
Summary
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T19:56:10.571065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T19:58:24.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T19:06:20.558715",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases"
},
{
"url": "https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.8"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.8"
},
{
"url": "https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-42008",
"datePublished": "2024-08-05T00:00:00",
"dateReserved": "2024-07-26T00:00:00",
"dateUpdated": "2024-08-07T19:58:24.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-37383
Vulnerability from cvelistv5
Published
2024-06-07 00:00
Modified
2024-10-24 16:20
Severity ?
EPSS score ?
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.6.7",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-37383",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T14:26:04.821037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-10-24",
"reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T16:20:22.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2024-10-24T00:00:00+00:00",
"value": "CVE-2024-37383 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T15:06:03.393167",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-37383",
"datePublished": "2024-06-07T00:00:00",
"dateReserved": "2024-06-07T00:00:00",
"dateUpdated": "2024-10-24T16:20:22.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000071
Vulnerability from cvelistv5
Published
2018-03-13 15:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/issues/6173 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.073Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6173"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-02-12T00:00:00",
"datePublic": "2018-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-13T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6173"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2/12/2018 5:20:44",
"ID": "CVE-2018-1000071",
"REQUESTER": "contact@legacysecuritygroup.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt",
"refsource": "MISC",
"url": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/6173",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/6173"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000071",
"datePublished": "2018-03-13T15:00:00",
"dateReserved": "2018-02-21T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-12641
Vulnerability from cvelistv5
Published
2020-05-04 14:58
Modified
2024-08-04 12:04
Severity ?
EPSS score ?
Summary
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.4 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4 | x_refsource_MISC | |
| https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3 | x_refsource_MISC | |
| https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube | x_refsource_MISC | |
| https://security.gentoo.org/glsa/202007-41 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:04:22.319Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T17:07:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"name": "GLSA-202007-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-12641",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"name": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"name": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10",
"refsource": "MISC",
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"name": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube",
"refsource": "MISC",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"name": "GLSA-202007-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"name": "openSUSE-SU-2020:1516",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-12641",
"datePublished": "2020-05-04T14:58:15",
"dateReserved": "2020-05-04T00:00:00",
"dateUpdated": "2024-08-04T12:04:22.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-44025
Vulnerability from cvelistv5
Published
2021-11-19 03:47
Modified
2024-08-04 04:10
Severity ?
EPSS score ?
Summary
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://bugs.debian.org/1000156 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/issues/8193 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/ | vendor-advisory, x_refsource_FEDORA | |
| https://www.debian.org/security/2021/dsa-5013 | vendor-advisory, x_refsource_DEBIAN | |
| https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:10:17.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.debian.org/1000156"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/8193"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7"
},
{
"name": "FEDORA-2021-167865df98",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment\u0027s filename extension when displaying a MIME type warning message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-06T21:06:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.debian.org/1000156"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/8193"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7"
},
{
"name": "FEDORA-2021-167865df98",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-44025",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment\u0027s filename extension when displaying a MIME type warning message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.debian.org/1000156",
"refsource": "MISC",
"url": "https://bugs.debian.org/1000156"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/8193",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/8193"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7"
},
{
"name": "FEDORA-2021-167865df98",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"name": "FEDORA-2021-43d3c10590",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"name": "DSA-5013",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"name": "[debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-44025",
"datePublished": "2021-11-19T03:47:48",
"dateReserved": "2021-11-19T00:00:00",
"dateUpdated": "2024-08-04T04:10:17.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-1491
Vulnerability from cvelistv5
Published
2011-04-08 15:00
Modified
2024-08-06 22:28
Severity ?
EPSS score ?
Summary
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.
References
| ▼ | URL | Tags |
|---|---|---|
| http://openwall.com/lists/oss-security/2011/03/24/3 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/changeset/4490 | x_refsource_CONFIRM | |
| http://openwall.com/lists/oss-security/2011/03/24/4 | mailing-list, x_refsource_MLIST | |
| http://openwall.com/lists/oss-security/2011/04/04/50 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/wiki/Changelog | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/66815 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:28:41.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110324 CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/4490"
},
{
"name": "[oss-security] 20110324 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"name": "[oss-security] 20110404 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "roundcube-login-info-disclosure(66815)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker\u0027s account and then compose an e-mail message, related to a \"login CSRF\" issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20110324 CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/4490"
},
{
"name": "[oss-security] 20110324 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"name": "[oss-security] 20110404 Re: CVE request: roundcube \u003c 0.5.1 CSRF",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"name": "roundcube-login-info-disclosure(66815)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1491",
"datePublished": "2011-04-08T15:00:00",
"dateReserved": "2011-03-21T00:00:00",
"dateUpdated": "2024-08-06T22:28:41.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-15237
Vulnerability from cvelistv5
Published
2019-08-20 00:39
Modified
2024-08-05 00:42
Severity ?
EPSS score ?
Summary
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/6891 | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/ | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:42:03.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6891"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-08T04:06:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6891"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-15237",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/6891",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/6891"
},
{
"name": "FEDORA-2019-d9c2f1ec70",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-15237",
"datePublished": "2019-08-20T00:39:53",
"dateReserved": "2019-08-19T00:00:00",
"dateUpdated": "2024-08-05T00:42:03.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-3508
Vulnerability from cvelistv5
Published
2012-08-25 10:00
Modified
2024-08-06 20:05
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/ticket/1488613 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/50279 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/08/20/9 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2012/08/20/2 | mailing-list, x_refsource_MLIST | |
| http://www.securelist.com/en/advisories/50279 | x_refsource_MISC | |
| http://sourceforge.net/news/?group_id=139281&id=309011 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:05:12.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"name": "50279",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50279"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securelist.com/en/advisories/50279"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using \"javascript:\" in an href attribute in the body of an HTML-formatted email."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-25T10:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"name": "50279",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50279"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee"
},
{
"name": "[oss-security] 20120820 Re: CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"name": "[oss-security] 20120820 CVE-request: Roundcube XSS issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securelist.com/en/advisories/50279"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-3508",
"datePublished": "2012-08-25T10:00:00Z",
"dateReserved": "2012-06-14T00:00:00Z",
"dateUpdated": "2024-08-06T20:05:12.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1904
Vulnerability from cvelistv5
Published
2014-02-08 00:00
Modified
2024-08-06 15:20
Severity ?
EPSS score ?
Summary
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
References
| ▼ | URL | Tags |
|---|---|---|
| http://habrahabr.ru/post/174423/ | x_refsource_MISC | |
| http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/ | x_refsource_CONFIRM | |
| http://lists.roundcube.net/pipermail/dev/2013-March/022328.html | mailing-list, x_refsource_MLIST | |
| http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html | vendor-advisory, x_refsource_SUSE | |
| http://www.openwall.com/lists/oss-security/2013/03/28/8 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:20:37.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://habrahabr.ru/post/174423/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
},
{
"name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
},
{
"name": "openSUSE-SU-2013:0671",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
},
{
"name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-07T22:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://habrahabr.ru/post/174423/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
},
{
"name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
},
{
"name": "openSUSE-SU-2013:0671",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
},
{
"name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-1904",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://habrahabr.ru/post/174423/",
"refsource": "MISC",
"url": "http://habrahabr.ru/post/174423/"
},
{
"name": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
},
{
"name": "[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)",
"refsource": "MLIST",
"url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
},
{
"name": "openSUSE-SU-2013:0671",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
},
{
"name": "[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-1904",
"datePublished": "2014-02-08T00:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:20:37.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-18671
Vulnerability from cvelistv5
Published
2021-06-24 18:14
Modified
2024-08-04 14:00
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/7406 | x_refsource_MISC | |
| https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | x_refsource_MISC | |
| https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:00:49.358Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in Roundcube Mail \u003c=1.4.4 via smtp config in /installer/test.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-24T18:14:12",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-18671",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulnerability in Roundcube Mail \u003c=1.4.4 via smtp config in /installer/test.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/7406",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"name": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12",
"refsource": "MISC",
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config",
"refsource": "MISC",
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-18671",
"datePublished": "2021-06-24T18:14:12",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:00:49.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-4552
Vulnerability from cvelistv5
Published
2016-12-20 22:00
Modified
2024-08-06 00:32
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/5240 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:32:25.887Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/5240"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120"
},
{
"name": "openSUSE-SU-2016:3309",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-05-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-12T22:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/5240"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120"
},
{
"name": "openSUSE-SU-2016:3309",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-4552",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/5240",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/5240"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120"
},
{
"name": "openSUSE-SU-2016:3309",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-4552",
"datePublished": "2016-12-20T22:00:00",
"dateReserved": "2016-05-06T00:00:00",
"dateUpdated": "2024-08-06T00:32:25.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5646
Vulnerability from cvelistv5
Published
2013-08-29 10:00
Modified
2024-09-17 01:56
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.roundcube.net/ticket/1489251 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:15:21.523Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1489251"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-29T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trac.roundcube.net/ticket/1489251"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5646",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.roundcube.net/ticket/1489251",
"refsource": "MISC",
"url": "http://trac.roundcube.net/ticket/1489251"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5646",
"datePublished": "2013-08-29T10:00:00Z",
"dateReserved": "2013-08-28T00:00:00Z",
"dateUpdated": "2024-09-17T01:56:53.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2937
Vulnerability from cvelistv5
Published
2011-09-21 16:00
Modified
2024-08-06 23:15
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2011/08/18/5 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2011/08/19/15 | mailing-list, x_refsource_MLIST | |
| http://trac.roundcube.net/changeset/5037 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/49229 | vdb-entry, x_refsource_BID | |
| http://support.apple.com/kb/HT5130 | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=731786 | x_refsource_CONFIRM | |
| http://sourceforge.net/news/?group_id=139281&id=302769 | x_refsource_CONFIRM | |
| http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG | x_refsource_CONFIRM | |
| http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html | vendor-advisory, x_refsource_APPLE | |
| http://trac.roundcube.net/ticket/1488030 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:15:31.995Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110818 CVE request: roundcube XSS before 0.5.4",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/08/18/5"
},
{
"name": "[oss-security] 20110819 Re: CVE request: roundcube XSS before 0.5.4",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/08/19/15"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/5037"
},
{
"name": "49229",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49229"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT5130"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731786"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=302769"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG"
},
{
"name": "APPLE-SA-2012-02-01-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1488030"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-08-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-02-04T10:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20110818 CVE request: roundcube XSS before 0.5.4",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/08/18/5"
},
{
"name": "[oss-security] 20110819 Re: CVE request: roundcube XSS before 0.5.4",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/08/19/15"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/5037"
},
{
"name": "49229",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49229"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT5130"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731786"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=302769"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG"
},
{
"name": "APPLE-SA-2012-02-01-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1488030"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-2937",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110818 CVE request: roundcube XSS before 0.5.4",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/08/18/5"
},
{
"name": "[oss-security] 20110819 Re: CVE request: roundcube XSS before 0.5.4",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/08/19/15"
},
{
"name": "http://trac.roundcube.net/changeset/5037",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/5037"
},
{
"name": "49229",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49229"
},
{
"name": "http://support.apple.com/kb/HT5130",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT5130"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=731786",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731786"
},
{
"name": "http://sourceforge.net/news/?group_id=139281\u0026id=302769",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=302769"
},
{
"name": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG"
},
{
"name": "APPLE-SA-2012-02-01-1",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"name": "http://trac.roundcube.net/ticket/1488030",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1488030"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2937",
"datePublished": "2011-09-21T16:00:00",
"dateReserved": "2011-07-27T00:00:00",
"dateUpdated": "2024-08-06T23:15:31.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-4068
Vulnerability from cvelistv5
Published
2017-04-13 14:00
Modified
2024-08-06 00:17
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:17:30.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-4068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-4068",
"datePublished": "2017-04-13T14:00:00",
"dateReserved": "2016-04-23T00:00:00",
"dateUpdated": "2024-08-06T00:17:30.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-16651
Vulnerability from cvelistv5
Published
2017-11-09 14:00
Modified
2024-08-05 20:27
Severity ?
EPSS score ?
Summary
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 | x_refsource_CONFIRM | |
| https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html | mailing-list, x_refsource_MLIST | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/101793 | vdb-entry, x_refsource_BID | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 | x_refsource_CONFIRM | |
| https://www.debian.org/security/2017/dsa-4030 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/roundcube/roundcubemail/issues/6026 | x_refsource_CONFIRM | |
| http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:27:04.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"name": "[debian-lts-announce] 20171128 [SECURITY] [DLA 1193-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"name": "101793",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101793"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"name": "DSA-4030",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2017/dsa-4030"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host\u0027s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-01T18:06:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"name": "[debian-lts-announce] 20171128 [SECURITY] [DLA 1193-1] roundcube security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"name": "101793",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101793"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"name": "DSA-4030",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2017/dsa-4030"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16651",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host\u0027s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"name": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"name": "[debian-lts-announce] 20171128 [SECURITY] [DLA 1193-1] roundcube security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"name": "101793",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101793"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"name": "DSA-4030",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2017/dsa-4030"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/6026",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"name": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16651",
"datePublished": "2017-11-09T14:00:00",
"dateReserved": "2017-11-07T00:00:00",
"dateUpdated": "2024-08-05T20:27:04.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19206
Vulnerability from cvelistv5
Published
2018-11-12 17:00
Modified
2024-08-05 11:30
Severity ?
EPSS score ?
Summary
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.8 | x_refsource_MISC | |
| https://www.debian.org/security/2018/dsa-4344 | vendor-advisory, x_refsource_DEBIAN | |
| https://roundcube.net/news/2018/10/26/update-1.3.8-released | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:30:04.222Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8"
},
{
"name": "DSA-4344",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4344"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://roundcube.net/news/2018/10/26/update-1.3.8-released"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-11-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of \u003csvg\u003e\u003cstyle\u003e, as demonstrated by an onload attribute in a BODY element, within an HTML attachment."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-25T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8"
},
{
"name": "DSA-4344",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4344"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://roundcube.net/news/2018/10/26/update-1.3.8-released"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19206",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of \u003csvg\u003e\u003cstyle\u003e, as demonstrated by an onload attribute in a BODY element, within an HTML attachment."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8"
},
{
"name": "DSA-4344",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4344"
},
{
"name": "https://roundcube.net/news/2018/10/26/update-1.3.8-released",
"refsource": "MISC",
"url": "https://roundcube.net/news/2018/10/26/update-1.3.8-released"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19206",
"datePublished": "2018-11-12T17:00:00",
"dateReserved": "2018-11-12T00:00:00",
"dateUpdated": "2024-08-05T11:30:04.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4368
Vulnerability from cvelistv5
Published
2005-12-20 02:00
Modified
2024-08-07 23:46
Severity ?
EPSS score ?
Summary
roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/422168/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/419710/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/418851/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:04.338Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060117 Re: Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/422168/100/0/threaded"
},
{
"name": "20051217 Re: Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/419710/100/0/threaded"
},
{
"name": "20051217 Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/418851/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "roundcube webmail Alpha, with a default high verbose level ($rcmail_config[\u0027debug_level\u0027] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060117 Re: Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/422168/100/0/threaded"
},
{
"name": "20051217 Re: Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/419710/100/0/threaded"
},
{
"name": "20051217 Fullpath disclosure in roundcube webmail",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/418851/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4368",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "roundcube webmail Alpha, with a default high verbose level ($rcmail_config[\u0027debug_level\u0027] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060117 Re: Fullpath disclosure in roundcube webmail",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/422168/100/0/threaded"
},
{
"name": "20051217 Re: Fullpath disclosure in roundcube webmail",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/419710/100/0/threaded"
},
{
"name": "20051217 Fullpath disclosure in roundcube webmail",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/418851/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4368",
"datePublished": "2005-12-20T02:00:00",
"dateReserved": "2005-12-20T00:00:00",
"dateUpdated": "2024-08-07T23:46:04.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-13964
Vulnerability from cvelistv5
Published
2020-06-09 02:45
Modified
2024-08-04 12:32
Severity ?
EPSS score ?
Summary
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19 | x_refsource_MISC | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.3.12 | x_refsource_MISC | |
| https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | x_refsource_CONFIRM | |
| https://www.debian.org/security/2020/dsa-4700 | vendor-advisory, x_refsource_DEBIAN | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/ | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:32:14.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-19T02:06:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13964",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"name": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"name": "DSA-4700",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"name": "FEDORA-2020-2a1a6a8432",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"name": "FEDORA-2020-aeffd92b77",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13964",
"datePublished": "2020-06-09T02:45:35",
"dateReserved": "2020-06-09T00:00:00",
"dateUpdated": "2024-08-04T12:32:14.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-9846
Vulnerability from cvelistv5
Published
2018-04-07 21:00
Modified
2024-08-05 07:24
Severity ?
EPSS score ?
Summary
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/issues/6238 | x_refsource_MISC | |
| https://www.debian.org/security/2018/dsa-4181 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/roundcube/roundcubemail/issues/6229 | x_refsource_MISC | |
| https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:24:56.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6238"
},
{
"name": "DSA-4181",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4181"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6229"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it\u0027s possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-29T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6238"
},
{
"name": "DSA-4181",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4181"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6229"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-9846",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it\u0027s possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/issues/6238",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/6238"
},
{
"name": "DSA-4181",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4181"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/6229",
"refsource": "MISC",
"url": "https://github.com/roundcube/roundcubemail/issues/6229"
},
{
"name": "https://medium.com/@ndrbasi/cve-2018-9846-roundcube-303097048b0a",
"refsource": "MISC",
"url": "https://medium.com/@ndrbasi/cve-2018-9846-roundcube-303097048b0a"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-9846",
"datePublished": "2018-04-07T21:00:00",
"dateReserved": "2018-04-07T00:00:00",
"dateUpdated": "2024-08-05T07:24:56.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-8864
Vulnerability from cvelistv5
Published
2017-04-13 14:00
Modified
2024-08-06 08:29
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 | x_refsource_CONFIRM | |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:22.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-8864",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-8864",
"datePublished": "2017-04-13T14:00:00",
"dateReserved": "2016-04-23T00:00:00",
"dateUpdated": "2024-08-06T08:29:22.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9920
Vulnerability from cvelistv5
Published
2016-12-08 18:00
Modified
2024-08-06 03:07
Severity ?
EPSS score ?
Summary
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ | x_refsource_MISC | |
| http://www.securityfocus.com/bid/94858 | vdb-entry, x_refsource_BID | |
| http://www.openwall.com/lists/oss-security/2016/12/08/10 | mailing-list, x_refsource_MLIST | |
| https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201612-44 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:07:31.413Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/"
},
{
"name": "94858",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94858"
},
{
"name": "[oss-security] 20161208 roundcube code execution via mail()",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/12/08/10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released"
},
{
"name": "GLSA-201612-44",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201612-44"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-12-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/"
},
{
"name": "94858",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94858"
},
{
"name": "[oss-security] 20161208 roundcube code execution via mail()",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/12/08/10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released"
},
{
"name": "GLSA-201612-44",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201612-44"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9920",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/",
"refsource": "MISC",
"url": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/"
},
{
"name": "94858",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94858"
},
{
"name": "[oss-security] 20161208 roundcube code execution via mail()",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/12/08/10"
},
{
"name": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released"
},
{
"name": "GLSA-201612-44",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201612-44"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9920",
"datePublished": "2016-12-08T18:00:00",
"dateReserved": "2016-12-08T00:00:00",
"dateUpdated": "2024-08-06T03:07:31.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-47272
Vulnerability from cvelistv5
Published
2023-11-05 00:00
Modified
2024-08-02 21:09
Severity ?
EPSS score ?
Summary
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:09:37.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"
},
{
"name": "FEDORA-2023-70578c5599",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"
},
{
"name": "FEDORA-2023-0fd9865145",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"
},
{
"name": "FEDORA-2023-cf584ed77a",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"
},
{
"name": "DSA-5572",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5572"
},
{
"name": "[debian-lts-announce] 20231204 [SECURITY] [DLA 3683-1] roundcube security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-05T01:06:29.421786",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"
},
{
"name": "FEDORA-2023-70578c5599",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"
},
{
"name": "FEDORA-2023-0fd9865145",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"
},
{
"name": "FEDORA-2023-cf584ed77a",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"
},
{
"name": "DSA-5572",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5572"
},
{
"name": "[debian-lts-announce] 20231204 [SECURITY] [DLA 3683-1] roundcube security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-47272",
"datePublished": "2023-11-05T00:00:00",
"dateReserved": "2023-11-05T00:00:00",
"dateUpdated": "2024-08-02T21:09:37.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2017-04-13 14:59
Modified
2024-11-21 02:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DDB20CBA-5A6E-4AAA-8ACF-91FF96488F4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "879B0231-CCBE-46C6-A270-FAE9153083E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9F775761-4DC1-4A73-A809-0B0F267FA572",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B923FB14-6700-4341-B63B-B09414C5C077",
"versionEndIncluding": "1.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55D54918-3ADC-4424-8F00-2E546803D94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "F43DB37D-E806-4404-B589-5A987E6E0659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4BB6095-C0D9-4D0A-9E8F-138BA1C19784",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4994583F-12AE-485C-B76C-C914A06D98F4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
},
{
"lang": "es",
"value": "La vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un SVG manipulado, una vulnerabilidad diferente a CVE-2016-4068."
}
],
"id": "CVE-2015-8864",
"lastModified": "2024-11-21T02:39:20.773",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-04-13T14:59:01.197",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-20 22:59
Modified
2024-11-21 02:52
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2:rc:*:*:*:*:*:*",
"matchCriteriaId": "ABB61C79-F895-4502-8B62-1B91026888B2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en Roundcube Webmail en versiones anteriores a 1.2.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del atributo href en una etiqueta de \u00e1rea en un mensaje de e-mail."
}
],
"id": "CVE-2016-4552",
"lastModified": "2024-11-21T02:52:27.800",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-20T22:59:00.227",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://github.com/roundcube/roundcubemail/issues/5240"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://github.com/roundcube/roundcubemail/issues/5240"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-07 21:29
Modified
2024-11-21 04:15
Severity ?
Summary
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/6229 | Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/6238 | Patch, Third Party Advisory | |
| cve@mitre.org | https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a | ||
| cve@mitre.org | https://www.debian.org/security/2018/dsa-4181 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/6229 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/6238 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2018/dsa-4181 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6311A2A8-28A1-4CA4-9CC9-8A2E9842247A",
"versionEndIncluding": "1.3.5",
"versionStartIncluding": "1.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it\u0027s possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism."
},
{
"lang": "es",
"value": "En Roundcube, de las versiones 1.2.0 a 1.3.5, con el plugin archive habilitado y configurado, es posible explotar el par\u00e1metro controlado por el usuario \"_uid\" no saneado (en una petici\u00f3n _task=mail_mbox=INBOX_action=plugin.move2archive en archive.php) para realizar un ataque de inyecci\u00f3n MX (IMAP) mediante la colocaci\u00f3n de un comando IMAP despu\u00e9s de una secuencia %0d%0a. NOTA: hay menos posibilidades de explotaci\u00f3n en las versiones 1.3.4 y posteriores debido al mecanismo de protecci\u00f3n Same Origin Policy."
}
],
"id": "CVE-2018-9846",
"lastModified": "2024-11-21T04:15:47.910",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-07T21:29:00.413",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6229"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6238"
},
{
"source": "cve@mitre.org",
"url": "https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4181"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6238"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4181"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-04 02:15
Modified
2024-11-21 04:59
Severity ?
Summary
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3C1E362-3888-4275-9386-8CF7CF1F492A",
"versionEndExcluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Roundcube Webmail versiones anteriores a 1.4.4. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo rcube_washtml.php porque el c\u00f3digo JavaScript puede aparecer en el CDATA de un mensaje HTML."
}
],
"id": "CVE-2020-12625",
"lastModified": "2024-11-21T04:59:56.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-04T02:15:11.520",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-04 15:15
Modified
2024-11-21 04:59
Severity ?
Summary
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
References
Impacted products
{
"cisaActionDue": "2023-07-13",
"cisaExploitAdd": "2023-06-22",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Roundcube Webmail Remote Code Execution Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A480FE5-CB10-4B95-91A4-4905FF92C28D",
"versionEndExcluding": "1.2.10",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD7B4A0-4163-46A5-95FE-B9F88D9E4F7F",
"versionEndExcluding": "1.3.11",
"versionStartIncluding": "1.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D3A5C6-648A-4866-92CE-F7D37D0F6122",
"versionEndExcluding": "1.4.4",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path."
},
{
"lang": "es",
"value": "El archivo rcube_image.php en Roundcube Webmail versiones anteriores a la versi\u00f3n 1.4.4, permite a atacantes ejecutar c\u00f3digo arbitrario por medio de metacaracteres de shell en un ajuste de configuraci\u00f3n para im_convert_path o im_identify_path."
}
],
"id": "CVE-2020-12641",
"lastModified": "2024-11-21T04:59:58.010",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-04T15:15:14.417",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-04-29 19:59
Modified
2024-11-21 03:33
Severity ?
Summary
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/98445 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 | Exploit, Third Party Advisory | |
| cve@mitre.org | https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201707-11 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/98445 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201707-11 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C97476E5-142E-447C-8C81-16BB6073E8D3",
"versionEndExcluding": "1.0.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8B912A-5567-48A4-A9FA-D1333BC1969B",
"versionEndExcluding": "1.1.9",
"versionStartIncluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "701E49A8-499B-4092-927A-D4B9276ACEA8",
"versionEndExcluding": "1.2.5",
"versionStartIncluding": "1.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin."
},
{
"lang": "es",
"value": "Roundcube Webmail permite reinicios de contrase\u00f1a arbitrarios por usuarios autenticados. Esto afecta a las versiones anteriores a la 1.0.11, entre la 1.1.x y la 1.1.9 y entre la 1.2.x y la 1.2.5. El problema es causado por una llamada exec incorrectamente restringida en los controladores virtualmin y sasl del plugin de contrase\u00f1a."
}
],
"id": "CVE-2017-8114",
"lastModified": "2024-11-21T03:33:20.983",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-04-29T19:59:00.217",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/98445"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201707-11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/98445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201707-11"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-06-04 15:55
Modified
2024-11-21 01:36
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.2.2 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 | |
| roundcube | webmail | 0.5.3 | |
| roundcube | webmail | 0.5.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48866819-1C42-4060-8871-550CC55F422E",
"versionEndIncluding": "0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anteriores a v0.7, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores que implican una imagen embebida adjunta."
}
],
"id": "CVE-2012-1253",
"lastModified": "2024-11-21T01:36:44.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-06-04T15:55:01.947",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN21422837/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN21422837/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-06 12:15
Modified
2024-11-21 05:05
Severity ?
Summary
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59E2619C-F903-46BF-BD0F-15BF3962FCD5",
"versionEndExcluding": "1.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3B61D09F-12E7-441A-A6E5-0F14D0782A81",
"versionEndExcluding": "1.3.14",
"versionStartIncluding": "1.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "15A19F05-5C84-4252-B9E4-E12A9EB2AD8F",
"versionEndExcluding": "1.4.7",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Roundcube Webmail versiones anteriores a 1.2.11, versiones 1.3.x anteriores a 1.3.14 y versiones 1.4.x anteriores a 1.4.7. Permite un ataque de tipo XSS por medio de un mensaje de correo electr\u00f3nico HTML dise\u00f1ado, como es demostrado por una carga \u00fatil de JavaScript en el atributo xmlns (tambi\u00e9n se conoce como espacio de nombres XML) de un elemento HEAD cuando se presenta un elemento SVG"
}
],
"id": "CVE-2020-15562",
"lastModified": "2024-11-21T05:05:44.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-06T12:15:10.720",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4720"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-20 02:03
Modified
2024-11-21 00:04
Severity ?
Summary
roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:-:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B3405D15-9AD6-4593-92BF-5368711CB34A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "roundcube webmail Alpha, with a default high verbose level ($rcmail_config[\u0027debug_level\u0027] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message."
}
],
"id": "CVE-2005-4368",
"lastModified": "2024-11-21T00:04:05.853",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-20T02:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/418851/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/419710/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/422168/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/418851/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/419710/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/422168/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-11-25 22:00
Modified
2024-11-21 01:08
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "340AB195-AEBC-4988-95E7-42624141CA9B",
"versionEndIncluding": "0.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Roundcube Webmail v0.2.2 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios sin especificar para peticiones que modifican la informaci\u00f3n del usuario a trav\u00e9s de vectores inespec\u00edficos, una vulnerabilidad diferente a CVE-2009-4077."
}
],
"id": "CVE-2009-4076",
"lastModified": "2024-11-21T01:08:52.577",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-11-25T22:00:00.610",
"references": [
{
"source": "cve@mitre.org",
"url": "http://jvn.jp/en/jp/JVN72974205/index.html"
},
{
"source": "cve@mitre.org",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37235"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/59661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN72974205/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000071.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37235"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/59661"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-08 00:55
Modified
2024-11-21 01:50
Severity ?
Summary
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63B0A1D9-711E-4694-9580-4144A54A6843",
"versionEndIncluding": "0.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "594EE4E3-9618-4E3C-8278-7782034184F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "607FF56D-EB06-434B-925F-D83763F4555B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC9286A-9537-4F18-8C73-61DE4506583B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4711358C-B12B-4B48-9AF8-49C8298BA451",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013."
},
{
"lang": "es",
"value": "Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una ruta completa en el par\u00e1metro _value para la configuraci\u00f3n generic_message_footer en una acci\u00f3n save-perf hacia index.php, tal y como se explot\u00f3 activamente en marzo de 2013."
}
],
"id": "CVE-2013-1904",
"lastModified": "2024-11-21T01:50:37.570",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-02-08T00:55:05.957",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://habrahabr.ru/post/174423/"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://habrahabr.ru/post/174423/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.roundcube.net/pipermail/dev/2013-March/022328.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/03/28/8"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-18 15:15
Modified
2024-11-21 08:42
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 | |
| debian | debian_linux | 12.0 | |
| fedoraproject | fedora | 39 |
{
"cisaActionDue": "2023-11-16",
"cisaExploitAdd": "2023-10-26",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A35A7DC-58C4-43F7-A66C-229B0A409224",
"versionEndExcluding": "1.4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF32BDE4-0C58-4D19-9E7C-CC0C0B22DF51",
"versionEndExcluding": "1.5.5",
"versionStartIncluding": "1.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BBAB5ECE-B692-46C2-A3EF-6BC52E4F3C3B",
"versionEndExcluding": "1.6.4",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nRoundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.\n\n\n\n\n\n\n\n"
},
{
"lang": "es",
"value": "Roundcube anterior a 1.4.15, 1.5.x anterior a 1.5.5 y 1.6.x anterior a 1.6.4 permiten almacenar XSS a trav\u00e9s de un mensaje de correo electr\u00f3nico HTML con un documento SVG manipulado debido al comportamiento de program/lib/Roundcube/rcube_washtml.php. Esto podr\u00eda permitir que un atacante remoto cargue c\u00f3digo JavaScript arbitrario."
}
],
"id": "CVE-2023-5631",
"lastModified": "2024-11-21T08:42:09.390",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security@eset.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-18T15:15:08.727",
"references": [
{
"source": "security@eset.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/1"
},
{
"source": "security@eset.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/3"
},
{
"source": "security@eset.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/17/2"
},
{
"source": "security@eset.com",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079"
},
{
"source": "security@eset.com",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d"
},
{
"source": "security@eset.com",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613"
},
{
"source": "security@eset.com",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/9168"
},
{
"source": "security@eset.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15"
},
{
"source": "security@eset.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5"
},
{
"source": "security@eset.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4"
},
{
"source": "security@eset.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html"
},
{
"source": "security@eset.com",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/"
},
{
"source": "security@eset.com",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released"
},
{
"source": "security@eset.com",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15"
},
{
"source": "security@eset.com",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5531"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/01/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/11/17/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/9168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/10/16/security-update-1.6.4-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5531"
}
],
"sourceIdentifier": "security@eset.com",
"vulnStatus": "Undergoing Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@eset.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-28 20:15
Modified
2024-11-21 05:27
Severity ?
Summary
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 | |
| debian | debian_linux | 9.0 |
{
"cisaActionDue": "2023-07-13",
"cisaExploitAdd": "2023-06-22",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A26F38AE-C3AB-4A9D-A097-F88FFF3351A1",
"versionEndExcluding": "1.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE535CF3-A0B8-4305-86BE-A6F2CD446827",
"versionEndExcluding": "1.3.16",
"versionStartIncluding": "1.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B77F6D2-7493-4ED5-997E-5D3A168B56D7",
"versionEndExcluding": "1.4.10",
"versionStartIncluding": "1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema de XSS en Roundcube Webmail en versiones anteriores a la 1.2.13, 1.3.x en versiones anteriores a la 1.3.16 y 1.4.x en versiones anteriores a la 1.4.10. El atacante puede enviar un mensaje de correo electr\u00f3nico de texto sin formato, con JavaScript en un elemento de referencia de enlace que es manejado inapropiadamente por linkref_addindex en rcube_string_replacer.php."
}
],
"id": "CVE-2020-35730",
"lastModified": "2024-11-21T05:27:57.943",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-28T20:15:13.150",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Mailing List"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://roundcube.net/download/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://www.alexbirnberg.com/roundcube-xss.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Mailing List"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://roundcube.net/download/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://www.alexbirnberg.com/roundcube-xss.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-01-29 19:59
Modified
2024-11-21 02:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://trac.roundcube.net/ticket/1490417 | Exploit, Issue Tracking, Patch | |
| cve@mitre.org | http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2 | Release Notes | |
| cve@mitre.org | https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://trac.roundcube.net/ticket/1490417 | Exploit, Issue Tracking, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2 | Release Notes | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F0563DDC-071C-46F2-8AAD-22CC7EBE5286",
"versionEndIncluding": "1.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3EDF68D9-C3DF-49CA-929F-1010F93F978C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EF1A038-BB16-4695-B22F-4FBFC4F233A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en program/include/rcmail.php en Roundcube en versiones anteriores a 1.0.6 y 1.1.x en versiones anteriores a 1.1.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro _mbox en una tarea correo a la URL por defecto, una vulnerabilidad diferente a CVE-2011-2937."
}
],
"id": "CVE-2015-8793",
"lastModified": "2024-11-21T02:39:12.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-01-29T19:59:05.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-24 19:15
Modified
2024-11-21 05:08
Severity ?
Summary
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/7406 | Patch, Third Party Advisory | |
| cve@mitre.org | https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php | Exploit, Third Party Advisory | |
| cve@mitre.org | https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/7406 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | Patch, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0DC944E9-76A5-4313-A21F-828B9BE16283",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Roundcube mail versi\u00f3n .4.4 por medio de la base de datos del host y del usuario en el archivo /installer/test.php"
}
],
"id": "CVE-2020-18670",
"lastModified": "2024-11-21T05:08:42.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-24T19:15:08.233",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#Store-Xss-in-installer-test-php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-25 10:29
Modified
2024-11-21 01:41
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.2.2 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 | |
| roundcube | webmail | 0.5.3 | |
| roundcube | webmail | 0.5.4 | |
| roundcube | webmail | 0.6 | |
| roundcube | webmail | 0.7 | |
| roundcube | webmail | 0.7.1 | |
| roundcube | webmail | 0.7.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC829320-BC61-4E9E-AA8F-350E610A3232",
"versionEndIncluding": "0.7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BDB491-F3CF-4C83-ABED-0C615B83D0E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzandos (XSS) en program/steps/mail/func.inc en Roundcube Webmail v0.8.0, cuando se usa el aspecto Larry, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del asunto de un mensaje de correo electr\u00f3nico"
}
],
"id": "CVE-2012-3507",
"lastModified": "2024-11-21T01:41:01.267",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-25T10:29:52.803",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/50212"
},
{
"source": "secalert@redhat.com",
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1488519"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securelist.com/en/advisories/50212"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/50212"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1488519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securelist.com/en/advisories/50212"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-09-22 06:15
Modified
2024-12-20 17:40
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
References
Impacted products
{
"cisaActionDue": "2024-03-04",
"cisaExploitAdd": "2024-02-12",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98F5DF3C-3CA0-4E0F-9C8A-7B18F3AEDB77",
"versionEndExcluding": "1.4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "772EC31F-EAC3-455E-953F-8FC04EA2A186",
"versionEndExcluding": "1.5.4",
"versionStartIncluding": "1.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "463446A7-DA28-41D3-B358-FA3BEBD6397E",
"versionEndExcluding": "1.6.3",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior."
},
{
"lang": "es",
"value": "Roundcube anterior a 1.4.14, 1.5.x anterior a 1.5.4 y 1.6.x anterior a 1.6.3 permiten XSS a trav\u00e9s de mensajes de texto/correo electr\u00f3nico plano con enlaces manipuados debido al comportamiento de program/lib/Roundcube/rcube_string_replacer.php."
}
],
"id": "CVE-2023-43770",
"lastModified": "2024-12-20T17:40:26.160",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-09-22T06:15:10.090",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/09/15/security-update-1.6.3-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://roundcube.net/news/2023/09/15/security-update-1.6.3-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-02-03 16:59
Modified
2024-11-21 02:25
Severity ?
Summary
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C0D9884-2DC7-4F56-85AA-0582A99316A1",
"versionEndIncluding": "1.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
"matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email."
},
{
"lang": "es",
"value": "program/lib/Roundcube/rcube_washtml.php en Roundcube anterior a 1.0.5 no cita correctamente las cadenas, lo que permite a atacantes remotos realizar ataques de XSS a trav\u00e9s del atributo de estilo en un email."
}
],
"id": "CVE-2015-1433",
"lastModified": "2024-11-21T02:25:25.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-02-03T16:59:24.983",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/changeset/786aa0725/github"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490227"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/72401"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2015/01/24/security-update-1.0.5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/changeset/786aa0725/github"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490227"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2015/01/31/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/72401"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-12-17 02:30
Modified
2024-11-21 00:54
Severity ?
Summary
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F467A8BF-1792-47E1-9C3D-4A4AB0DD17AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "E083F7E9-44BE-4247-B93B-20E326D7FBF0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch."
},
{
"lang": "es",
"value": "html2text.php en Chuggnutt HTML a Text Converter, como se usa en PHPMailer en versiones anteriores a 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha y 0.2-3.beta, Mahara y AtMail Open 1.03, permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de entrada manipulada que se procesa por la funci\u00f3n preg_replace con el interruptor de eval."
}
],
"id": "CVE-2008-5619",
"lastModified": "2024-11-21T00:54:28.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-12-17T02:30:00.250",
"references": [
{
"source": "cve@mitre.org",
"url": "http://mahara.org/interaction/forum/topic.php?id=533"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/53893"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33145"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33170"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34789"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/changeset/2148"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1485618"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2008/12/12/1"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/499489/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/3419"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/7549"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/7553"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://mahara.org/interaction/forum/topic.php?id=533"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/53893"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34789"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/changeset/2148"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1485618"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2008/12/12/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/499489/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/3419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/7549"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/7553"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-07 04:15
Modified
2024-12-20 16:52
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
References
Impacted products
{
"cisaActionDue": "2024-11-14",
"cisaExploitAdd": "2024-10-24",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "018530A6-4785-49CC-8868-90824E79CA82",
"versionEndExcluding": "1.5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1964E474-BED1-4806-A9D0-848BC3D93C0E",
"versionEndExcluding": "1.6.7",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes."
},
{
"lang": "es",
"value": "Roundcube Webmail anterior a 1.5.7 y 1.6.x anterior a 1.6.7 permite XSS a trav\u00e9s de atributos animados SVG."
}
],
"id": "CVE-2024-37383",
"lastModified": "2024-12-20T16:52:05.623",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-06-07T04:15:30.463",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-11-12 17:29
Modified
2024-11-21 03:57
Severity ?
Summary
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/releases/tag/1.3.8 | Release Notes | |
| cve@mitre.org | https://roundcube.net/news/2018/10/26/update-1.3.8-released | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.debian.org/security/2018/dsa-4344 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/releases/tag/1.3.8 | Release Notes | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2018/10/26/update-1.3.8-released | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2018/dsa-4344 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC99AD2B-5C88-4774-9D30-4FEDFAA7F1E2",
"versionEndExcluding": "1.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of \u003csvg\u003e\u003cstyle\u003e, as demonstrated by an onload attribute in a BODY element, within an HTML attachment."
},
{
"lang": "es",
"value": "steps/mail/func.inc en Roundcube en versiones anteriores a la 1.3.8 tiene Cross-Site Scripting (XSS) mediante el uso manipulado de"
}
],
"id": "CVE-2018-19206",
"lastModified": "2024-11-21T03:57:33.303",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-11-12T17:29:00.287",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2018/10/26/update-1.3.8-released"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4344"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2018/10/26/update-1.3.8-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4344"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-01-29 18:30
Modified
2024-11-21 01:12
Severity ?
Summary
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.2.2 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12C3ED93-48DB-4220-8416-DB138ED87630",
"versionEndIncluding": "0.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests."
},
{
"lang": "es",
"value": "Roundcube v0.3.1 y anteriores no solicitan que el navegador web permita el \"prefetching\" DNS de los nombres de dominio contenidos en mensajes de correo electr\u00f3nico, lo que facilita a atacantes remotos determinar la localizaci\u00f3n de red del usuario de webmail mediante peticiones de logggin DNS."
}
],
"id": "CVE-2010-0464",
"lastModified": "2024-11-21T01:12:16.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-01-29T18:30:01.137",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1486449"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:048"
},
{
"source": "cve@mitre.org",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1486449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:048"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-24 19:15
Modified
2024-11-21 05:08
Severity ?
Summary
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/7406 | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config | Exploit, Third Party Advisory | |
| cve@mitre.org | https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/7406 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 | Patch, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E887879-F6E5-4D66-A150-C038178A5C58",
"versionEndIncluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in Roundcube Mail \u003c=1.4.4 via smtp config in /installer/test.php."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Roundcube Mail versiones anteriores a 1.4.4 incluy\u00e9ndola, por medio del par\u00e1metro smtp config en el archivo /installer/test.php"
}
],
"id": "CVE-2020-18671",
"lastModified": "2024-11-21T05:08:42.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-24T19:15:08.267",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/7406"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://lorexxar.cn/2020/06/10/roundcube-mail-xss/#store-xss-in-smtp-config"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-08-05 19:15
Modified
2024-09-06 21:48
Severity ?
Summary
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC573DD9-42FE-4467-89E4-E3DAC9E3C744",
"versionEndExcluding": "1.5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "350AC515-3D8C-48E1-9D73-023609560C8A",
"versionEndExcluding": "1.6.8",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting vulnerability in rcmail_action_mail_get-\u003erun() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting en rcmail_action_mail_get-\u0026gt;run() en Roundcube hasta 1.5.7 y 1.6.x hasta 1.6.7 permite a un atacante remoto robar y enviar correos electr\u00f3nicos de una v\u00edctima a trav\u00e9s de un archivo adjunto de correo electr\u00f3nico malicioso servido con un archivo peligroso. Encabezado de tipo de contenido."
}
],
"id": "CVE-2024-42008",
"lastModified": "2024-09-06T21:48:31.597",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.8,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-05T19:15:38.153",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description"
],
"url": "https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-23 04:29
Modified
2024-11-21 02:32
Severity ?
Summary
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DDB20CBA-5A6E-4AAA-8ACF-91FF96488F4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55D54918-3ADC-4424-8F00-2E546803D94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "F43DB37D-E806-4404-B589-5A987E6E0659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4BB6095-C0D9-4D0A-9E8F-138BA1C19784",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
},
{
"lang": "es",
"value": "Roundcube Webmail versiones 1.1.x anteriores a la 1.1.2, permitir\u00eda a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de la lectura de ficheros en los directorios (1) config, (2) temp, o (3) logs."
}
],
"id": "CVE-2015-5383",
"lastModified": "2024-11-21T02:32:55.790",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-23T04:29:00.667",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-04-08 15:17
Modified
2024-11-21 01:26
Severity ?
Summary
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2E961628-4624-4095-8CE6-698F66BF462B",
"versionEndIncluding": "0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker\u0027s account and then compose an e-mail message, related to a \"login CSRF\" issue."
},
{
"lang": "es",
"value": "El formulario de login en Roundcube Webmail anterior a v0.5.1 no maneja correctamente un intento de login no intencionado, lo que hace m\u00e1s f\u00e1cil para usuarios remotos autenticados de obtener informaci\u00f3n sensible haciendo que una v\u00edctima haga login en la cuenta del atacante para luego componer un e-mail, relacionado con un problema de \"login CSRF\"."
}
],
"id": "CVE-2011-1491",
"lastModified": "2024-11-21T01:26:26.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-04-08T15:17:28.400",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/4490"
},
{
"source": "secalert@redhat.com",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/4490"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66815"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-23 04:29
Modified
2024-11-21 02:32
Severity ?
Summary
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | roundcube_webmail | * | |
| roundcube | roundcube_webmail | 1.1.1 | |
| roundcube | webmail | 1.1 | |
| roundcube | webmail | 1.1 | |
| roundcube | webmail | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8DD8E608-8097-4332-B75D-75FACA46A6DD",
"versionEndIncluding": "1.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DDB20CBA-5A6E-4AAA-8ACF-91FF96488F4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55D54918-3ADC-4424-8F00-2E546803D94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "F43DB37D-E806-4404-B589-5A987E6E0659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4BB6095-C0D9-4D0A-9E8F-138BA1C19784",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
},
{
"lang": "es",
"value": "program/steps/addressbook/photo.inc en Roundcube Webmail, en versiones anteriores a la 1.0.6 y 1.1.x anteriores a la 1.1.2, permitir\u00eda a usuarios remotos autenticados leer ficheros arbitrarios a trav\u00e9s del par\u00e1metro _alt parameter cuando cargamos una vCard."
}
],
"id": "CVE-2015-5382",
"lastModified": "2024-11-21T02:32:55.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-23T04:29:00.603",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-02-03 23:30
Modified
2024-11-21 00:59
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en RoundCube Webmail (roundcubemail) v0.2 stable, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elecci\u00f3n a trav\u00e9s de un atributo oculto incrustado en un correo electr\u00f3nico HTML."
}
],
"id": "CVE-2009-0413",
"lastModified": "2024-11-21T00:59:50.940",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-02-03T23:30:00.967",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33622"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33827"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/changeset/2245"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/33372"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2009/0192"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48129"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33622"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33827"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/changeset/2245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/33372"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2009/0192"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-09 14:29
Modified
2024-11-21 03:16
Severity ?
Summary
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 1.2.0 | |
| roundcube | webmail | 1.2.1 | |
| roundcube | webmail | 1.2.2 | |
| roundcube | webmail | 1.2.3 | |
| roundcube | webmail | 1.2.4 | |
| roundcube | webmail | 1.2.5 | |
| roundcube | webmail | 1.2.6 | |
| roundcube | webmail | 1.3.0 | |
| roundcube | webmail | 1.3.1 | |
| roundcube | webmail | 1.3.2 | |
| debian | debian_linux | 7.0 | |
| debian | debian_linux | 9.0 |
{
"cisaActionDue": "2022-05-03",
"cisaExploitAdd": "2021-11-03",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Roundcube Webmail File Disclosure Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5F9E6CBE-8E6F-4BE0-8DBD-521527119EBF",
"versionEndIncluding": "1.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6556D4DF-FFF9-4EE0-91EA-84314D7CF071",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98A43C92-1266-47DB-B3D9-A12CFE271EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEFDA8E6-5BD6-4A20-8B67-C9597B67DABA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7DB074D9-E258-471F-9FF7-CABE43E763DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "BD2B08B4-5484-440C-AB40-CAAB41508920",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "23D7F18F-FFA7-4D10-B1F6-1499D6F8DB72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "C112540F-4CCC-48A9-A30D-D5E808151D43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4913F9D6-868C-4AB3-A4CC-03257A417573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "975DDE40-CE7F-4425-B2F0-523D36894010",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E4FBA242-E194-49DE-A740-7216BBFE2039",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host\u0027s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests."
},
{
"lang": "es",
"value": "Roundcube Webmail, en versiones anteriores a la 1.1.10, versiones 1.2.x anteriores a la 1.2.7 y y versiones 1.3.x anteriores a la 1.3.3, permite el acceso no autorizado a archivos arbitrarios en el sistema de archivos del host, incluyendo archivos de configuraci\u00f3n, tal y como se explot\u00f3 en Noviembre 2017 pero sin publicar ninguna prueba de concepto oficial. El atacante debe ser capaz de autenticarse en el sistema objetivo con un nombre de usuario y una contrase\u00f1a v\u00e1lidos, ya que el ataque necesita una sesi\u00f3n activa. El problema est\u00e1 relacionado con los plugins para adjuntar archivos y las peticiones _task=settings_action=upload-display_from=timezone."
}
],
"id": "CVE-2017-16651",
"lastModified": "2024-11-21T03:16:45.910",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-09T14:29:00.267",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101793"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2017/dsa-4030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101793"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2017/dsa-4030"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-552"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-08-12 13:15
Modified
2024-11-21 05:06
Severity ?
Summary
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6AA0D87C-F59C-4A8D-8527-8171BEB076E0",
"versionEndExcluding": "1.3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F4ECE92-6974-4D4F-9900-5F0C548B912A",
"versionEndExcluding": "1.4.8",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15."
},
{
"lang": "es",
"value": "Roundcube Webmail versiones anteriores a 1.3.15 y 1.4.8, permite un ataque de tipo XSS almacenado en mensajes HTML durante la visualizaci\u00f3n de mensajes por medio de un documento SVG dise\u00f1ado. Este problema se ha solucionado en la versi\u00f3n 1.4.8 y versi\u00f3n 1.3.15."
}
],
"id": "CVE-2020-16145",
"lastModified": "2024-11-21T05:06:50.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-12T13:15:10.457",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b#diff-d3bb3391c79904494c60ee2ac2f33070"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DAXK3565NYK4OEZVTW6S5LEVIDQEY2E/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLUQRIBAMEQVBO6GUZECCHJDJIWCYFU/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-30 22:59
Modified
2024-11-21 02:26
Severity ?
Summary
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:rc:*:*:*:*:*:*",
"matchCriteriaId": "B227F6FD-A62A-404D-8D3F-A7853120FD0D",
"versionEndIncluding": "1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password."
},
{
"lang": "es",
"value": "El controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de los metacaracteres de shell en la contrase\u00f1a."
}
],
"id": "CVE-2015-2180",
"lastModified": "2024-11-21T02:26:55.557",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-30T22:59:00.140",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96387"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-30 22:59
Modified
2024-11-21 02:26
Severity ?
Summary
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/96391 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/4757 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/96391 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/4757 | Exploit, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3FE3538F-01A8-4AEA-84D0-6D4F7195DD10",
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username."
},
{
"lang": "es",
"value": "Varios desbordamientos de b\u00fafer en el controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permiten a atacantes remotos tener un impacto no especificado a trav\u00e9s de (1) la contrase\u00f1a o (2) el nombre de usuario."
}
],
"id": "CVE-2015-2181",
"lastModified": "2024-11-21T02:26:55.720",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-30T22:59:00.187",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/96391"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/96391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4757"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-06 00:15
Modified
2024-11-21 08:30
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 37 | |
| fedoraproject | fedora | 38 | |
| fedoraproject | fedora | 39 | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 | |
| debian | debian_linux | 12.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B2ED2ED-CC1A-4FDD-B9B4-1FA5CCD6DC60",
"versionEndExcluding": "1.5.6",
"versionStartIncluding": "1.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EB0E97CB-55FA-43CB-A85F-252CC55731ED",
"versionEndExcluding": "1.6.5",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download)."
},
{
"lang": "es",
"value": "Roundcube 1.5.x anterior a 1.5.6 y 1.6.x anterior a 1.6.5 permite XSS a trav\u00e9s de un encabezado Content-Type o Content-Disposition (utilizado para la vista previa o descarga de archivos adjuntos)."
}
],
"id": "CVE-2023-47272",
"lastModified": "2024-11-21T08:30:05.950",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-06T00:15:09.380",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GILSR762MJB3BNJOVOCMW2JXEPV46IIQ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFRGBPET73URF6364CI547ZVWQESJLGK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4F4DUA3Q46ZVB2RD7BFP4XMNS4RYFFQ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5572"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-08-05 19:15
Modified
2024-09-06 21:50
Severity ?
Summary
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC573DD9-42FE-4467-89E4-E3DAC9E3C744",
"versionEndExcluding": "1.5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "350AC515-3D8C-48E1-9D73-023609560C8A",
"versionEndExcluding": "1.6.8",
"versionStartIncluding": "1.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting en Roundcube hasta 1.5.7 y 1.6.x hasta 1.6.7 permite a un atacante remoto robar y enviar correos electr\u00f3nicos de una v\u00edctima a trav\u00e9s de un mensaje de correo electr\u00f3nico manipulado que abusa de un problema de desanitizaci\u00f3n en message_body() en program/actions/mail/show.php. "
}
],
"id": "CVE-2024-42009",
"lastModified": "2024-09-06T21:50:47.813",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.8,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-05T19:15:38.220",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description"
],
"url": "https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-12-12 01:46
Modified
2024-11-21 00:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C38B97E6-1906-4C39-BC8D-BEA2233C5BF8",
"versionEndIncluding": "0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en RoundCube webmail 0.1rc2, 2007-12-09, y versiones anteriores, cuando utiliza Internet Explorer, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de expresi\u00f3n que contiene los comandos."
}
],
"id": "CVE-2007-6321",
"lastModified": "2024-11-21T00:39:52.003",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-12-12T01:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://openmya.hacker.jp/hasegawa/security/expression.txt"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/30734"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securityreason.com/securityalert/3435"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1484701"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/484802/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/26800"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38981"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://openmya.hacker.jp/hasegawa/security/expression.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/30734"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securityreason.com/securityalert/3435"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1484701"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/484802/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/26800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38981"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-04 15:15
Modified
2024-11-21 04:59
Severity ?
Summary
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A480FE5-CB10-4B95-91A4-4905FF92C28D",
"versionEndExcluding": "1.2.10",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD7B4A0-4163-46A5-95FE-B9F88D9E4F7F",
"versionEndExcluding": "1.3.11",
"versionStartIncluding": "1.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D3A5C6-648A-4866-92CE-F7D37D0F6122",
"versionEndExcluding": "1.4.4",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php."
},
{
"lang": "es",
"value": "Roundcube Webmail versiones anteriores a la versi\u00f3n 1.4.4, permite a atacantes incluir archivos locales y ejecutar c\u00f3digo por medio de un salto de directorio en un nombre de plugin en archivo rcube_plugin_api.php."
}
],
"id": "CVE-2020-12640",
"lastModified": "2024-11-21T04:59:57.847",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-04T15:15:14.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-09 03:15
Modified
2024-11-21 05:02
Severity ?
Summary
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289A3A4F-39FC-46C8-9A65-566CF3D37242",
"versionEndExcluding": "1.3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE4389EE-4AFC-4D15-8E9D-52FCD6302EE6",
"versionEndExcluding": "1.4.5",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Roundcube Webmail versiones anteriores a 1.3.12. En el archivo include/rcmail_output_html.php permite un ataque de tipo XSS por medio del objeto de plantilla de nombre de usuario"
}
],
"id": "CVE-2020-13964",
"lastModified": "2024-11-21T05:02:15.303",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-09T03:15:11.187",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/37e2bc745723ef6322f0f785aefd0b9313a40f19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-07 15:29
Modified
2024-11-21 04:19
Severity ?
Summary
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| fedoraproject | fedora | 29 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "21944990-D120-49D4-8C58-2395666903D2",
"versionEndExcluding": "1.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker."
},
{
"lang": "es",
"value": "En Roundcube Webmail en versiones anteriores a la 1.3.10, un atacante en posesi\u00f3n de correos electr\u00f3nicos cifrados S/MIME o PGP puede envolverlos como subparte dentro de un correo electr\u00f3nico multiparte dise\u00f1ado. La(s) parte(s) encriptada(s) puede ocultarse a\u00fan m\u00e1s usando caracteres HTML/CSS o de nueva l\u00ednea ASCII. El atacante puede reenviar este correo electr\u00f3nico multiparte modificado al destinatario previsto. Si el destinatario responde a este correo electr\u00f3nico (de aspecto benigno), sin saberlo, filtra el texto plano de la(s) parte(s) del mensaje cifrado al atacante."
}
],
"id": "CVE-2019-10740",
"lastModified": "2024-11-21T04:19:49.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-07T15:29:00.387",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6638"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6638"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-319"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-21 16:55
Modified
2024-11-21 01:29
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "36DD0D87-55AA-4596-93B5-D95697CCB6F5",
"versionEndIncluding": "0.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en la funcionalidad de mensajes de interfaz de usuario en Roundcube Webmail antes de la versi\u00f3n v0.5.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro _mbox a la URI por defecto."
}
],
"id": "CVE-2011-2937",
"lastModified": "2024-11-21T01:29:18.957",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-09-21T16:55:03.210",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"source": "secalert@redhat.com",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=302769"
},
{
"source": "secalert@redhat.com",
"url": "http://support.apple.com/kb/HT5130"
},
{
"source": "secalert@redhat.com",
"url": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/5037"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1488030"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/08/18/5"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/08/19/15"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/49229"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731786"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=302769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.apple.com/kb/HT5130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/browser/tags/roundcubemail/v0.5.4/CHANGELOG"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/5037"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1488030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/08/18/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/08/19/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/49229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731786"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-20 01:15
Modified
2024-11-21 04:28
Severity ?
Summary
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| fedoraproject | fedora | 29 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E026289F-2446-4DAE-B99F-617267BB8DA4",
"versionEndIncluding": "1.3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks."
},
{
"lang": "es",
"value": "Roundcube Webmail versiones hasta 1.3.9, maneja inapropiadamente los nombres de dominio Punycode xn--, conllevando a ataques homogr\u00e1ficos."
}
],
"id": "CVE-2019-15237",
"lastModified": "2024-11-21T04:28:15.890",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-20T01:15:09.977",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6891"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6891"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-02-09 09:15
Modified
2024-11-21 05:57
Severity ?
Summary
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "645F0117-1B83-476C-8E8A-1C51A3549B3D",
"versionEndExcluding": "1.4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering."
},
{
"lang": "es",
"value": "Roundcube versiones anteriores a 1.4.11, permite ataque de tipo XSS por medio de secuencias de tokens de Cascading Style Sheets (CSS) dise\u00f1adas durante el renderizado de correo electr\u00f3nico HTML"
}
],
"id": "CVE-2021-26925",
"lastModified": "2024-11-21T05:57:03.373",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-02-09T09:15:13.617",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://roundcube.net/news/2021/02/08/security-update-1.4.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://roundcube.net/news/2021/02/08/security-update-1.4.11"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-11-12 17:29
Modified
2024-11-21 03:57
Severity ?
Summary
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/releases/tag/1.3.7 | Release Notes | |
| cve@mitre.org | https://roundcube.net/news/2018/07/27/update-1.3.7-released | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/releases/tag/1.3.7 | Release Notes | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2018/07/27/update-1.3.7-released | Release Notes, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F12A7FCF-BD04-4B16-B70D-AD9B2F6EE3F8",
"versionEndExcluding": "1.3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php."
},
{
"lang": "es",
"value": "Roundcube en versiones anteriores a la 1.3.7 gestiona de manera incorrecta las advertencias de integridad/protecci\u00f3n GnuPG MDC, lo que facilita que los atacantes obtengan informaci\u00f3n sensible. Esto est\u00e1 relacionado con CVE-2017-17688. Esto est\u00e1 asociado con plugins/enigma/lib/enigma_driver_gnupg.php."
}
],
"id": "CVE-2018-19205",
"lastModified": "2024-11-21T03:57:33.150",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-11-12T17:29:00.223",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2018/07/27/update-1.3.7-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2018/07/27/update-1.3.7-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-04-13 14:59
Modified
2024-11-21 02:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DDB20CBA-5A6E-4AAA-8ACF-91FF96488F4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "879B0231-CCBE-46C6-A270-FAE9153083E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9F775761-4DC1-4A73-A809-0B0F267FA572",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B923FB14-6700-4341-B63B-B09414C5C077",
"versionEndIncluding": "1.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55D54918-3ADC-4424-8F00-2E546803D94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "F43DB37D-E806-4404-B589-5A987E6E0659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4BB6095-C0D9-4D0A-9E8F-138BA1C19784",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4994583F-12AE-485C-B76C-C914A06D98F4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
},
{
"lang": "es",
"value": "Vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar scripts web o HTML a trav\u00e9s de un SVG manipulado, una vulnerabilidad diferente a CVE-2015-8864."
}
],
"id": "CVE-2016-4068",
"lastModified": "2024-11-21T02:51:17.343",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-04-13T14:59:01.713",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-23 04:29
Modified
2024-11-21 02:32
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DDB20CBA-5A6E-4AAA-8ACF-91FF96488F4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55D54918-3ADC-4424-8F00-2E546803D94C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "F43DB37D-E806-4404-B589-5A987E6E0659",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4BB6095-C0D9-4D0A-9E8F-138BA1C19784",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
},
{
"lang": "es",
"value": "Vulnerabilidad de tipo Cross-site scripting (XSS) en program/include/rcmail.php en Roundcube Webmail, versiones 1.1.x anteriores a la 1.1.2, que permitir\u00eda a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s del par\u00e1metro _mbox en la URI por defecto."
}
],
"id": "CVE-2015-5381",
"lastModified": "2024-11-21T02:32:55.463",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-23T04:29:00.540",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-02-24 21:55
Modified
2024-11-21 01:45
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.2.2 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 | |
| roundcube | webmail | 0.5.3 | |
| roundcube | webmail | 0.5.4 | |
| roundcube | webmail | 0.6 | |
| roundcube | webmail | 0.7 | |
| roundcube | webmail | 0.7.1 | |
| roundcube | webmail | 0.7.2 | |
| roundcube | webmail | 0.7.3 | |
| roundcube | webmail | 0.8.0 | |
| roundcube | webmail | 0.8.1 | |
| roundcube | webmail | 0.8.2 | |
| roundcube | webmail | 0.8.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84EA2E88-A7A5-4DCB-A7E2-D8E4DC7CEB3C",
"versionEndIncluding": "0.8.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BDB491-F3CF-4C83-ABED-0C615B83D0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DCD7759D-4C21-4EC5-A150-C717B71D5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "594EE4E3-9618-4E3C-8278-7782034184F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "607FF56D-EB06-434B-925F-D83763F4555B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anterior a v0.8.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del enlace (1) data:text o (2) vbscript.\r\n"
}
],
"id": "CVE-2012-6121",
"lastModified": "2024-11-21T01:45:51.993",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-02-24T21:55:01.063",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"source": "secalert@redhat.com",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=310213"
},
{
"source": "secalert@redhat.com",
"url": "http://trac.roundcube.net/ticket/1488850"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/02/08/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/57849"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=310213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/ticket/1488850"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/02/08/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/57849"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-12 05:59
Modified
2024-11-21 03:30
Severity ?
Summary
rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47063171-0D2F-4987-91BA-051FFD0D7B3F",
"versionEndIncluding": "1.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6556D4DF-FFF9-4EE0-91EA-84314D7CF071",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98A43C92-1266-47DB-B3D9-A12CFE271EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEFDA8E6-5BD6-4A20-8B67-C9597B67DABA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7DB074D9-E258-471F-9FF7-CABE43E763DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element."
},
{
"lang": "es",
"value": "rcube_utils.php en Roundcube en versiones anteriores a 1.1.8 y 1.2.x en versiones anteriores a 1.2.4 es susceptible a una vulnerabilidad de XSS a trav\u00e9s una secuencia de tokens de CSS manipulada dentro de un elemento SVG."
}
],
"id": "CVE-2017-6820",
"lastModified": "2024-11-21T03:30:36.400",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-12T05:59:00.277",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96817"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96817"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-25 10:29
Modified
2024-11-21 01:41
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using \"javascript:\" in an href attribute in the body of an HTML-formatted email."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzandos (XSS) en program/lib/washtml.php en Roundcube Webmail v0.8.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML usando \"javascript:\" en un atributo href en el cuerpo de un correo electr\u00f3nico formateado en HTML."
}
],
"id": "CVE-2012-3508",
"lastModified": "2024-11-21T01:41:01.397",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-25T10:29:52.850",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/50279"
},
{
"source": "secalert@redhat.com",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
},
{
"source": "secalert@redhat.com",
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securelist.com/en/advisories/50279"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/50279"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securelist.com/en/advisories/50279"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-05 18:55
Modified
2024-11-21 01:58
Severity ?
Summary
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A856547-A191-487D-B870-11908CEDFDE9",
"versionEndIncluding": "0.8.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BDB491-F3CF-4C83-ABED-0C615B83D0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DCD7759D-4C21-4EC5-A150-C717B71D5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "594EE4E3-9618-4E3C-8278-7782034184F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "607FF56D-EB06-434B-925F-D83763F4555B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC9286A-9537-4F18-8C73-61DE4506583B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4711358C-B12B-4B48-9AF8-49C8298BA451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:beta:*:*:*:*:*:*",
"matchCriteriaId": "FCE48787-9394-4572-AEBD-F6541D7C2AC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:rc:*:*:*:*:*:*",
"matchCriteriaId": "04B18A6B-3ADB-4014-8244-424577362E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7A50C2A4-D2BE-4899-B5A8-838583119FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BC5F6ADA-C532-4FC6-87CA-9DB3533FF71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C61C6AD6-3DB5-483C-83E8-CDFF74BF39A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6A71BD9F-B121-4A36-9B1C-1C257264F999",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "55A3DA20-BA5A-471E-9D34-837C3A1D4E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A014F13A-8A40-4655-BDF4-58F94D78F790",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code."
},
{
"lang": "es",
"value": "steps/utils/save_pref.inc en Roundcube webmail anterior a la versi\u00f3n 0.8.7 y 0.9.x anterior a 0.9.5 permite a atacantes remotos modificar las opciones de configuraci\u00f3n a trav\u00e9s del par\u00e1metro _session, que se puede aprovechar para leer archivos arbitrarios, llevar a cabo ataques de inyecci\u00f3n SQL, y ejecutar c\u00f3digo arbitrario."
}
],
"id": "CVE-2013-6172",
"lastModified": "2024-11-21T01:58:46.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-11-05T18:55:06.243",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1489382"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2787"
},
{
"source": "cve@mitre.org",
"url": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2013/10/21/security-updates-095-and-087/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1489382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-13 15:29
Modified
2024-11-21 03:39
Severity ?
Summary
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/roundcube/roundcubemail/issues/6173 | Third Party Advisory | |
| cve@mitre.org | https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/roundcube/roundcubemail/issues/6173 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt | Exploit, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78C4B727-C796-4E2C-8781-144F624AF08D",
"versionEndIncluding": "1.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity."
},
{
"lang": "es",
"value": "roundcube, en versiones 1.3.4 y anteriores, contiene una vulnerabilidad de permisos inseguros en el plugin enigma que puede resultar en la exfiltraci\u00f3n de la clave privada gpgp. Este ataque parece ser explotable mediante conectividad de red."
}
],
"id": "CVE-2018-1000071",
"lastModified": "2024-11-21T03:39:34.297",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-13T15:29:00.330",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6173"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/6173"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-11-10 17:59
Modified
2024-11-21 02:38
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48E4D2B9-0585-4F56-82E2-03D83784E80D",
"versionEndIncluding": "1.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3EDF68D9-C3DF-49CA-929F-1010F93F978C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EF1A038-BB16-4695-B22F-4FBFC4F233A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CE82903F-DE4F-47A8-BF41-BABD373A8819",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en program/js/app.js en Roundcube webmail en versiones anteriores a 1.0.7 y 1.1.x en versiones anteriores a 1.1.3 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del nombre de archivo en una subida de archivo de arrastrar y pegar."
}
],
"id": "CVE-2015-8105",
"lastModified": "2024-11-21T02:38:01.573",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-11-10T17:59:13.090",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/changeset/dd7db2179/github"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490530"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/changeset/dd7db2179/github"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://trac.roundcube.net/ticket/1490530"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201603-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-11-03 15:55
Modified
2024-11-21 01:31
Severity ?
Summary
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 | |
| roundcube | webmail | 0.5.3 | |
| php | php | 5.3.7 | |
| php | php | 5.3.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD9D199-073E-429F-8617-AEAA9A3EE1DA",
"versionEndIncluding": "0.5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "ACDF768D-7F5A-4042-B7DD-398F65F3F094",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2AF35BB6-C6B1-4683-A8BE-AA72CC34F5B5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379."
},
{
"lang": "es",
"value": "inclinclude/iniset.php en Roundcube Webmail v0.5.4 y anteriores, cuando PHP v5.3.7 o v5.3.8 se utiliza, permite a atacantes remotos provocar una solicitud GET para una direcci\u00f3n arbitraria, y provocar una denegaci\u00f3n de servicio (consumo de recursos y la interrupci\u00f3n de la bandeja de entrada), a trav\u00e9s de un encabezado de asunto que s\u00f3lo contiene una URL, un asunto relacionado con CVE-2011-3379."
}
],
"id": "CVE-2011-4078",
"lastModified": "2024-11-21T01:31:48.233",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-11-03T15:55:00.887",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"source": "secalert@redhat.com",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/10/26/6"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1488086"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/50402"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71025"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/10/26/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/ticket/1488086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/50402"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71025"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-08-25 18:59
Modified
2024-11-21 02:51
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01EF6262-F377-47C1-8929-3A099A85FFBA",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en Roundcube Webmail en versiones anteriores a1.1.5 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios para peticiones que descargan archivos adjuntos y provocar una denegaci\u00f3n del servicio (consumo del disco) a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-4069",
"lastModified": "2024-11-21T02:51:17.457",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-25T18:59:00.097",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/04/23/4"
},
{
"source": "security@debian.org",
"url": "http://www.securityfocus.com/bid/92654"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Mailing List"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4957"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/04/23/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92654"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Mailing List"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-25 10:29
Modified
2024-11-21 01:43
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.2.2 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5.1 | |
| roundcube | webmail | 0.5.2 | |
| roundcube | webmail | 0.5.3 | |
| roundcube | webmail | 0.5.4 | |
| roundcube | webmail | 0.6 | |
| roundcube | webmail | 0.7 | |
| roundcube | webmail | 0.7.1 | |
| roundcube | webmail | 0.7.2 | |
| roundcube | webmail | 0.7.3 | |
| roundcube | webmail | 0.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A70E3E3-F447-4DE8-B5F5-2FCD8E1A2408",
"versionEndIncluding": "0.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BDB491-F3CF-4C83-ABED-0C615B83D0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DCD7759D-4C21-4EC5-A150-C717B71D5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en Roundcube Webmail v0.8.1 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de la firma en un correo electr\u00f3nico."
}
],
"id": "CVE-2012-4668",
"lastModified": "2024-11-21T01:43:18.590",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-25T10:29:53.100",
"references": [
{
"source": "cve@mitre.org",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/news/?group_id=139281\u0026id=309011"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/ticket/1488613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/20/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-11-19 04:15
Modified
2024-11-21 06:30
Severity ?
Summary
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA15B6EF-37D5-4C52-ACE8-BFC70EC57247",
"versionEndExcluding": "1.3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A9DC05-E22B-4AFF-BA40-7B48BA545461",
"versionEndExcluding": "1.4.12",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment\u0027s filename extension when displaying a MIME type warning message."
},
{
"lang": "es",
"value": "Roundcube versiones anteriores a 1.3.17 y versiones 1.4.x anteriores a 1.4.12, es propenso a un ataque de tipo XSS en el manejo de la extensi\u00f3n del nombre del archivo adjunto cuando se muestra un mensaje de advertencia de tipo MIME"
}
],
"id": "CVE-2021-44025",
"lastModified": "2024-11-21T06:30:14.413",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-11-19T04:15:06.900",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/1000156"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/8193"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/1000156"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/issues/8193"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-11-25 22:00
Modified
2024-11-21 01:08
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "340AB195-AEBC-4988-95E7-42624141CA9B",
"versionEndIncluding": "0.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Roundcube Webmail v0.2.2 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios sin especificar para peticiones que env\u00edan correos electr\u00f3nicos arbitrarios a trav\u00e9s de vectores sin especificar, una vulnerabilidad diferente a CVE-2009-4076."
}
],
"id": "CVE-2009-4077",
"lastModified": "2024-11-21T01:08:52.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-11-25T22:00:00.670",
"references": [
{
"source": "cve@mitre.org",
"url": "http://jvn.jp/en/jp/JVN75694913/index.html"
},
{
"source": "cve@mitre.org",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37235"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/59661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN75694913/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000072.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37235"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/59661"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-11-19 04:15
Modified
2024-11-21 06:30
Severity ?
Summary
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 |
{
"cisaActionDue": "2023-07-13",
"cisaExploitAdd": "2023-06-22",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Roundcube Webmail SQL Injection Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA15B6EF-37D5-4C52-ACE8-BFC70EC57247",
"versionEndExcluding": "1.3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A9DC05-E22B-4AFF-BA40-7B48BA545461",
"versionEndExcluding": "1.4.12",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params."
},
{
"lang": "es",
"value": "Roundcube versiones anteriores a 1.3.17 y versiones 1.4.x anteriores a 1.4.12, es propenso a una potencial inyecci\u00f3n SQL por medio de los par\u00e1metros search o search_params"
}
],
"id": "CVE-2021-44026",
"lastModified": "2024-11-21T06:30:14.627",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-11-19T04:15:07.197",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch"
],
"url": "https://bugs.debian.org/1000156"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch"
],
"url": "https://bugs.debian.org/1000156"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Release Notes"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5013"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-29 12:07
Modified
2024-11-21 01:57
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.0:git:*:*:*:*:*:*",
"matchCriteriaId": "FF6956F6-6325-43FE-86BE-A4854B73CC0B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group."
},
{
"lang": "es",
"value": "Vulnerabilidad Cross-site scripting (XSS) en Roundcube webmail v1.0-git, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s del campo \"Name\" de un grupo de la libreta de direcciones."
}
],
"id": "CVE-2013-5646",
"lastModified": "2024-11-21T01:57:52.403",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-29T12:07:56.177",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1489251"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.roundcube.net/ticket/1489251"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-09 03:15
Modified
2024-11-21 05:02
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Summary
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 |
{
"cisaActionDue": "2024-07-17",
"cisaExploitAdd": "2024-06-26",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "289A3A4F-39FC-46C8-9A65-566CF3D37242",
"versionEndExcluding": "1.3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE4389EE-4AFC-4D15-8E9D-52FCD6302EE6",
"versionEndExcluding": "1.4.5",
"versionStartIncluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Roundcube Webmail versiones anteriores a 1.3.12. Se presenta una vulnerabilidad de tipo XSS por medio de un archivo adjunto XML malicioso porque text/xml se encuentra entre los tipos permitidos para una vista previa"
}
],
"id": "CVE-2020-13965",
"lastModified": "2024-11-21T05:02:15.457",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2020-06-09T03:15:11.250",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4700"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-80"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-04 02:15
Modified
2024-11-21 04:59
Severity ?
Summary
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3C1E362-3888-4275-9386-8CF7CF1F492A",
"versionEndExcluding": "1.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Roundcube Webmail versiones anteriores a 1.4.4. Un ataque de tipo CSRF puede causar que un usuario autenticado cierre sesi\u00f3n porque POST no se consider\u00f3."
}
],
"id": "CVE-2020-12626",
"lastModified": "2024-11-21T04:59:56.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-04T02:15:11.693",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/pull/7302"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/pull/7302"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.4.4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202007-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4674"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-12-17 02:30
Modified
2024-11-21 00:54
Severity ?
Summary
RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:alpha:*:*:*:*:*:*",
"matchCriteriaId": "26E8CB38-3388-4150-8DE1-5F89B1DEA0DE",
"versionEndIncluding": "0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image."
},
{
"lang": "es",
"value": "RoundCube Webmail (roundcubemail) antes de la v0.2-beta permite a atacantes remotos producir una denegaci\u00f3n de servicio (agotamiento de memoria) a trav\u00e9s de par\u00e1metros de tama\u00f1o manipulados que son usado para crear una imagen de cuota grande."
}
],
"id": "CVE-2008-5620",
"lastModified": "2024-11-21T00:54:28.290",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-12-17T02:30:00.267",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=898542"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/3418"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47550"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-29 12:07
Modified
2024-11-21 01:57
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E505F998-E9E8-4827-B34A-953261157522",
"versionEndIncluding": "0.9.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050811:*:*:*:*:*:*",
"matchCriteriaId": "6E525B8F-ED49-494A-A9C1-CCFFDCFAAA11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20050820:*:*:*:*:*:*",
"matchCriteriaId": "A9C38F5E-A79B-45F4-AD0C-894DE7ADD8EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051007:*:*:*:*:*:*",
"matchCriteriaId": "8BDB7224-1922-41BC-82F1-187DEEEE60DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:20051021:*:*:*:*:*:*",
"matchCriteriaId": "9019C121-5D96-4967-92FA-AA63FAD40435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:stable:*:*:*:*:*:*",
"matchCriteriaId": "BADA5A07-C90D-4000-A973-0A918E390D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:stable:*:*:*:*:*:*",
"matchCriteriaId": "84126D1E-F709-4F23-A541-B92B6ED01D3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D572A44-701A-4D6F-919F-AB8AE4BF4417",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:stable:*:*:*:*:*:*",
"matchCriteriaId": "141BFB80-F895-482C-B2ED-A6FB9135EA9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B276CD07-EB81-4C59-B0E8-83E43EAAB005",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "08BC43EB-D26F-48D7-A614-76FAEC07DB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1E653FFD-AA00-4F30-B844-85AFA5A5A31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BBA46B2E-0FEA-4B17-8E72-381656E07349",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1DC5945-5C18-40F2-AC79-32FF740A7F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B6230C0E-D3A2-4A2E-B6F1-E0695F6E8802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "589AFC14-DC69-4B0B-B22B-74A8B40D63E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "13A61889-D3B2-46A4-A9A8-60136F8A490B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BDB491-F3CF-4C83-ABED-0C615B83D0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DCD7759D-4C21-4EC5-A150-C717B71D5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04DC85A0-F2AB-4A89-A3B9-853BAB1E0CD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5C1C76-D1A6-4E22-AE50-8AE587F83AAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "594EE4E3-9618-4E3C-8278-7782034184F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "607FF56D-EB06-434B-925F-D83763F4555B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC9286A-9537-4F18-8C73-61DE4506583B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4711358C-B12B-4B48-9AF8-49C8298BA451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "EA19760B-BA10-4B5B-9DAB-FCC3D6EC40A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:beta:*:*:*:*:*:*",
"matchCriteriaId": "FCE48787-9394-4572-AEBD-F6541D7C2AC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:rc:*:*:*:*:*:*",
"matchCriteriaId": "04B18A6B-3ADB-4014-8244-424577362E3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7A50C2A4-D2BE-4899-B5A8-838583119FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BC5F6ADA-C532-4FC6-87CA-9DB3533FF71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C61C6AD6-3DB5-483C-83E8-CDFF74BF39A3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de cross-site scripting (XSS) en Roundcube webmail anterior a v0.9.3, permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a trav\u00e9s del cuerpo de un mensaje visit\u00f3 en el modo (1) \"new\" o (2) \"draft\", relacionado con compose.inc; y (3), permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de una firma HTML, relacionada con save_identity.inc."
}
],
"id": "CVE-2013-5645",
"lastModified": "2024-11-21T01:57:52.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-29T12:07:56.147",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/ticket/1489251"
},
{
"source": "cve@mitre.org",
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/ticket/1489251"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-08 18:59
Modified
2024-11-21 03:02
Severity ?
Summary
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.openwall.com/lists/oss-security/2016/12/08/10 | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/94858 | ||
| cve@mitre.org | https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ | Exploit, Third Party Advisory | |
| cve@mitre.org | https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201612-44 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2016/12/08/10 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94858 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201612-44 |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47DB8BF5-B1EE-49BD-AFE3-4383AAC0B2C3",
"versionEndIncluding": "1.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6556D4DF-FFF9-4EE0-91EA-84314D7CF071",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98A43C92-1266-47DB-B3D9-A12CFE271EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEFDA8E6-5BD6-4A20-8B67-C9597B67DABA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message."
},
{
"lang": "es",
"value": "steps/mail/sendmail.inc en Roundcube en versiones anteriores a 1.1.7 y 1.2.x en versiones anteriores a 1.2.3, cuando ning\u00fan servidor SMTP est\u00e1 configurado y el programa sendmail est\u00e1 habilitado, no restringe adecuadamente el uso de direcciones personalizadas envelope-from en la l\u00ednea de comando de sendmail, lo que permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario a trav\u00e9s de una petici\u00f3n HTTP modificada que env\u00eda un mensaje de correo electr\u00f3nico manipulado."
}
],
"id": "CVE-2016-9920",
"lastModified": "2024-11-21T03:02:01.020",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-08T18:59:00.200",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/12/08/10"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94858"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201612-44"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/12/08/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://blog.ripstech.com/2016/roundcube-command-execution-via-email/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201612-44"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-05-16 19:29
Modified
2024-11-21 03:18
Severity ?
Summary
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
"matchCriteriaId": "217117AE-C16C-4265-A9A9-152D06FCD64E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
"matchCriteriaId": "081D62F6-B751-4109-B10B-3CF9535B3C12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F389CED1-846A-4807-B8E7-00FBECAA41A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
"matchCriteriaId": "930AFDDA-C32A-45E7-BA6E-5827E59B573B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED2616EA-332D-4D6E-B66C-137A166E181D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2C26D918-1548-4A62-BC5C-72DF9168A34E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAD39AA-B9FD-492B-9BDA-57F74F4FABE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
"matchCriteriaId": "D789259A-034E-40BB-9DFF-76B3104B212F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF583CDC-DE9E-45AB-9861-CB203BFA8862",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0BA111F-A9FB-457D-818E-412195F9EA0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19296516-EAD4-4B08-8D9A-5E853C7BEF58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5010756A-99B8-4C05-9DAC-9BE19B8B6373",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification"
},
{
"lang": "es",
"value": "** EN DISPUTA ** La especificaci\u00f3n OpenPGP permite un ataque malleability-gadget Cipher Feedback Mode (CFB) que puede conducir indirectamente a la exfiltraci\u00f3n en texto plano. Esto tambi\u00e9n se conoce como EFAIL. NOTA: terceros indican que este es un problema en aplicaciones que gestionan de manera incorrecta la caracter\u00edstica de Modification Detection Code (MDC) o que afectan un tipo de paquete obsoleto, en lugar de un problema en la especificaci\u00f3n OpenPGP."
}
],
"id": "CVE-2017-17688",
"lastModified": "2024-11-21T03:18:27.723",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-05-16T19:29:00.223",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104162"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040904"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mitigation",
"Third Party Advisory"
],
"url": "https://efail.de"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040904"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mitigation",
"Third Party Advisory"
],
"url": "https://efail.de"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_18_22"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-01-15 15:59
Modified
2024-11-21 02:21
Severity ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F0BC22E0-32B4-493F-8514-34991AED0862",
"versionEndIncluding": "1.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de CSRF en Roundcube Webmail anterior a 1.0.4 permite a atacantes remotos secuestrar la autenticaci\u00f3n de victimas no especificadas a trav\u00e9s de vectores no especificadas, relacionado con (1) operaciones del libro de direcciones o los plugins (2) ACL o (3) Managesieve."
}
],
"id": "CVE-2014-9587",
"lastModified": "2024-11-21T02:21:11.807",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-01-15T15:59:21.547",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71909"
},
{
"source": "cve@mitre.org",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://roundcube.net/news/2014/12/18/update-1.0.4-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2015/01/11/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71909"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=534766"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179780"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-04-08 15:17
Modified
2024-11-21 01:26
Severity ?
Summary
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | webmail | * | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1 | |
| roundcube | webmail | 0.1.1 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2 | |
| roundcube | webmail | 0.2.1 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3 | |
| roundcube | webmail | 0.3.1 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4 | |
| roundcube | webmail | 0.4.1 | |
| roundcube | webmail | 0.4.2 | |
| roundcube | webmail | 0.5 | |
| roundcube | webmail | 0.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2E961628-4624-4095-8CE6-698F66BF462B",
"versionEndIncluding": "0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4C785B00-7F4D-4EBD-A9FA-726D4D35E5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8F433741-5F73-43B5-A522-C484C64C66A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta:*:*:*:*:*:*",
"matchCriteriaId": "09DF755B-041E-4A61-BEF6-A613F6F0CE13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "34D20437-7DE7-4DB8-8C11-37B09A87E3A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "55FB4AA3-3528-46B7-BBB9-9185DAA5425C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "066AA2BC-95A8-43E8-A1FE-9F15860691E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82FB886B-35A4-4A8C-AE18-62C845886018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83FF6973-9BAC-4DF2-BACE-42F0D9340A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "EB6449FD-C6EE-497C-BE34-88900883AD09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "0CEF8BF6-E09F-4376-B089-9B722A84F591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "946B0B6A-46D3-46B9-BD1E-B03D3339EEB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D4D6EA96-EE58-47C3-B545-7238B3F64941",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:beta:*:*:*:*:*:*",
"matchCriteriaId": "3584BB62-818D-4A5B-BC7D-EAB0B85614EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "332FF744-3682-4818-9602-8F868BF0781E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B502047-4DDD-4586-978C-6CEE1C41F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "43581564-48CF-410C-9CE1-CBAE71153DA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4:beta:*:*:*:*:*:*",
"matchCriteriaId": "6A5CC548-05E4-4059-8252-FA78ECBB95A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3FA495A-D7FE-4461-AF57-EB649A1C49B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D773E61-113A-4EE8-804E-0584B73AB58D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:beta:*:*:*:*:*:*",
"matchCriteriaId": "FC0D4825-F78E-40F5-A9CB-45B73DE8FBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:roundcube:webmail:0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "9C8376B9-4DF2-4E23-9C43-EEDE3D800519",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request."
},
{
"lang": "es",
"value": "steps/utils/modcss.inc en Roundcube Webmail anterior a v0.5.1 no comprueba correctamente que una solicitud es una solicitud esperada para una hoja de estilo externa (Cascading Style Sheets), permitiendo a usuarios remotos autenticados lanzar conexiones arbitrarias salientes TCP desde el servidor , y posiblemente obtener informaci\u00f3n sensible, a trav\u00e9s de una solicitud manipulada."
}
],
"id": "CVE-2011-1492",
"lastModified": "2024-11-21T01:26:26.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-04-08T15:17:28.447",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/44050"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/4488"
},
{
"source": "secalert@redhat.com",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/03/24/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/03/24/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/04/04/50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/44050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://trac.roundcube.net/changeset/4488"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://trac.roundcube.net/wiki/Changelog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66613"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-201805-0227
Vulnerability from variot
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user's e-mail client. The discoverer can attack with this vulnerability "CBC/CFB gadget attack" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * CVE-2017-17688: OpenPGP CFB Attacks * CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, Articles provided by the discoverer Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201805-0227",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "webmail",
"scope": "eq",
"trust": 1.6,
"vendor": "roundcube",
"version": null
},
{
"model": "emclient",
"scope": "eq",
"trust": 1.0,
"vendor": "emclient",
"version": null
},
{
"model": "imp",
"scope": "eq",
"trust": 1.0,
"vendor": "horde",
"version": null
},
{
"model": "mail",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": null
},
{
"model": "postbox",
"scope": "eq",
"trust": 1.0,
"vendor": "postbox",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 1.0,
"vendor": "bloop",
"version": null
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 1.0,
"vendor": "mozilla",
"version": null
},
{
"model": "maildroid",
"scope": "eq",
"trust": 1.0,
"vendor": "flipdogsolutions",
"version": null
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 1.0,
"vendor": "r2mail2",
"version": null
},
{
"model": "mailmate",
"scope": "eq",
"trust": 1.0,
"vendor": "freron",
"version": null
},
{
"model": "outlook",
"scope": "eq",
"trust": 1.0,
"vendor": "microsoft",
"version": "2007"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "9folders",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "airmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "evolution",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "flipdog",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gpgtools",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gnupg",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "google",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "kmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mailmate",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "mozilla",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "postbox",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "r2mail2",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ritlabs srl",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "roundcube",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the enigmail",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the horde",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "trojita",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "em client",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "round cube webmail",
"scope": "eq",
"trust": 0.3,
"vendor": "roundcube",
"version": "0"
},
{
"model": "r2mail2",
"scope": "eq",
"trust": 0.3,
"vendor": "r2mail2",
"version": "0"
},
{
"model": "postbox",
"scope": "eq",
"trust": 0.3,
"vendor": "postbox",
"version": "0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.5.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.024"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.12"
},
{
"model": "thunderbird beta",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.52"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.13"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "9.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "9.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "8.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "7.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "7.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "52"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "5.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "45.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "38.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "32.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "31"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.19"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.17"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "3.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.6"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "24.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "23.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.23"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.22"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.21"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.20"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.18"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "2.0.0.11"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.9"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "17.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "16"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "15"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "13.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "12.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "11.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.3"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0.1"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "10.0"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.8"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.7"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.5"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.4"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.2"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.14"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.12"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.10"
},
{
"model": "thunderbird",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.5.0.1"
},
{
"model": "thunderbird beta",
"scope": "eq",
"trust": 0.3,
"vendor": "mozilla",
"version": "1.0.5"
},
{
"model": "outlook",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "20070"
},
{
"model": "project horde imp",
"scope": "eq",
"trust": 0.3,
"vendor": "horde",
"version": "0"
},
{
"model": "solutions maildroid",
"scope": "eq",
"trust": 0.3,
"vendor": "flipdog",
"version": "0"
},
{
"model": "enigmail",
"scope": "eq",
"trust": 0.3,
"vendor": "enigmail",
"version": "0"
},
{
"model": "client em client",
"scope": "eq",
"trust": 0.3,
"vendor": "em",
"version": "0"
},
{
"model": "mail",
"scope": null,
"trust": 0.3,
"vendor": "apple",
"version": null
},
{
"model": "airmail",
"scope": "eq",
"trust": 0.3,
"vendor": "airmail",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:roundcube:webmail:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Damian Poddebniak, Christian Dresen, Jens M\u00fcller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jorg Schwenk.",
"sources": [
{
"db": "BID",
"id": "104162"
}
],
"trust": 0.3
},
"cve": "CVE-2017-17688",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-108735",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-17688",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-17688",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201712-725",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-108735",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-17688",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user\u0027s e-mail client. The discoverer can attack with this vulnerability \"CBC/CFB gadget attack\" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * *CVE-2017-17688: OpenPGP CFB Attacks * *CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, \u003ca href=\"https://efail.de/efail-attack-paper.pdf\" target=\"blank\"\u003e Articles provided by the discoverer \u003c/a\u003e Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-17688"
},
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-17688",
"trust": 2.9
},
{
"db": "BID",
"id": "104162",
"trust": 2.1
},
{
"db": "CERT/CC",
"id": "VU#122919",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1040904",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU95575473",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-108735",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-17688",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"id": "VAR-201805-0227",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
}
],
"trust": 0.01
},
"last_update_date": "2024-05-17T19:19:57.881000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Debian CVElist Bug Report Logs: enigmail: efail attack against enigmail",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=56a8018aac811c8d81b81ef5a6c3623a"
},
{
"title": "Red Hat: CVE-2017-17688",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-17688"
},
{
"title": "Efail-malleability-gadget-exploit",
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit "
},
{
"title": "more\nBoring bugs",
"trust": 0.1,
"url": "https://github.com/hannob/pgpbugs "
},
{
"title": "SecDB - Security Feeds",
"trust": 0.1,
"url": "https://github.com/giterlizzi/secdb-feeds "
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2018/05/14/smime_pgp_encryption_flaw_emails_vulnerable_to_snooping/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-17688"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-310",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://efail.de/"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/104162"
},
{
"trust": 1.8,
"url": "https://www.synology.com/support/security/synology_sa_18_22"
},
{
"trust": 1.8,
"url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
},
{
"trust": 1.8,
"url": "https://efail.de"
},
{
"trust": 1.8,
"url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-may/060334.html"
},
{
"trust": 1.8,
"url": "https://news.ycombinator.com/item?id=17066419"
},
{
"trust": 1.8,
"url": "https://protonmail.com/blog/pgp-vulnerability-efail"
},
{
"trust": 1.8,
"url": "https://twitter.com/matthew_d_green/status/995996706457243648"
},
{
"trust": 1.8,
"url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id/1040904"
},
{
"trust": 1.6,
"url": "https://efail.de/efail-attack-paper.pdf"
},
{
"trust": 1.2,
"url": "https://www.kb.cert.org/vuls/id/122919"
},
{
"trust": 0.8,
"url": "https://tools.ietf.org/html/rfc4880"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17688"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu95575473/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17689"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-17688"
},
{
"trust": 0.3,
"url": "https://www.openpgp.org/"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1577906"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-17688"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898630"
},
{
"trust": 0.1,
"url": "https://github.com/jaads/efail-malleability-gadget-exploit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#122919"
},
{
"db": "VULHUB",
"id": "VHN-108735"
},
{
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"db": "BID",
"id": "104162"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-14T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULHUB",
"id": "VHN-108735"
},
{
"date": "2018-05-16T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"date": "2018-05-14T00:00:00",
"db": "BID",
"id": "104162"
},
{
"date": "2018-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2017-12-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"date": "2018-05-16T19:29:00.223000",
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-15T00:00:00",
"db": "CERT/CC",
"id": "VU#122919"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-108735"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-17688"
},
{
"date": "2018-05-15T10:00:00",
"db": "BID",
"id": "104162"
},
{
"date": "2018-08-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012995"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-725"
},
{
"date": "2024-05-17T01:16:13.807000",
"db": "NVD",
"id": "CVE-2017-17688"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OpenPGP and S/MIME mail client vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#122919"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-725"
}
],
"trust": 0.6
}
}