Show filters
68 Total Results
Displaying 31-40 of 68
Sort by:
Attacker Value
Unknown
CVE-2015-5383
Disclosure Date: May 23, 2017 (last updated November 26, 2024)
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
0
Attacker Value
Unknown
CVE-2015-5381
Disclosure Date: May 23, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
0
Attacker Value
Unknown
CVE-2017-8114
Disclosure Date: April 29, 2017 (last updated November 26, 2024)
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
0
Attacker Value
Unknown
CVE-2015-8864
Disclosure Date: April 13, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
0
Attacker Value
Unknown
CVE-2016-4068
Disclosure Date: April 13, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
0
Attacker Value
Unknown
CVE-2017-6820
Disclosure Date: March 12, 2017 (last updated November 26, 2024)
rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.
0
Attacker Value
Unknown
CVE-2015-2180
Disclosure Date: January 30, 2017 (last updated November 25, 2024)
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
0
Attacker Value
Unknown
CVE-2015-2181
Disclosure Date: January 30, 2017 (last updated November 25, 2024)
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
0
Attacker Value
Unknown
CVE-2016-4552
Disclosure Date: December 20, 2016 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.
0
Attacker Value
Unknown
CVE-2016-9920
Disclosure Date: December 08, 2016 (last updated November 25, 2024)
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
0
