CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 1CVE-2013-5646
https://notcve.org/view.php?id=CVE-2013-5646
Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group. Vulnerabilidad Cross-site scripting (XSS) en Roundcube webmail v1.0-git, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a través del campo "Name" de un grupo de la libreta de direcciones. • http://trac.roundcube.net/ticket/1489251 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 2CVE-2013-5645 – Roundcube Webmail 0.9.2 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-5645
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. Múltiples vulnerabilidades de cross-site scripting (XSS) en Roundcube webmail anterior a v0.9.3, permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a través del cuerpo de un mensaje visitó en el modo (1) "new" o (2) "draft", relacionado con compose.inc; y (3), permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una firma HTML, relacionada con save_identity.inc. Roundcube Webmail version 0.9.2 suffers from a cross site scripting vulnerability. • http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github http://trac.roundcube.net/ticket/1489251 http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 44EXPL: 0CVE-2013-1904
https://notcve.org/view.php?id=CVE-2013-1904
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013. Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos arbitrarios a través de una ruta completa en el parámetro _value para la configuración generic_message_footer en una acción save-perf hacia index.php, tal y como se explotó activamente en marzo de 2013. • http://habrahabr.ru/post/174423 http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html http://lists.roundcube.net/pipermail/dev/2013-March/022328.html http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073 http://www.openwall.com/lists/oss-security/2013/03/28/8 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2012-6121
https://notcve.org/view.php?id=CVE-2012-6121
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anterior a v0.8.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del enlace (1) data:text o (2) vbscript. • http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html http://sourceforge.net/news/?group_id=139281&id=310213 http://trac.roundcube.net/ticket/1488850 http://www.openwall.com/lists/oss-security/2013/02/08/1 http://www.securityfocus.com/bid/57849 https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2012-3508 – Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-3508
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzandos (XSS) en program/lib/washtml.php en Roundcube Webmail v0.8.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML usando "javascript:" en un atributo href en el cuerpo de un correo electrónico formateado en HTML. • https://www.exploit-db.com/exploits/20549 http://secunia.com/advisories/50279 http://sourceforge.net/news/?group_id=139281&id=309011 http://trac.roundcube.net/ticket/1488613 http://www.openwall.com/lists/oss-security/2012/08/20/2 http://www.openwall.com/lists/oss-security/2012/08/20/9 http://www.securelist.com/en/advisories/50279 https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •