CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2012-6121
https://notcve.org/view.php?id=CVE-2012-6121
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anterior a v0.8.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del enlace (1) data:text o (2) vbscript. • http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html http://sourceforge.net/news/?group_id=139281&id=310213 http://trac.roundcube.net/ticket/1488850 http://www.openwall.com/lists/oss-security/2013/02/08/1 http://www.securityfocus.com/bid/57849 https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2012-3508 – Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-3508
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzandos (XSS) en program/lib/washtml.php en Roundcube Webmail v0.8.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML usando "javascript:" en un atributo href en el cuerpo de un correo electrónico formateado en HTML. • https://www.exploit-db.com/exploits/20549 http://secunia.com/advisories/50279 http://sourceforge.net/news/?group_id=139281&id=309011 http://trac.roundcube.net/ticket/1488613 http://www.openwall.com/lists/oss-security/2012/08/20/2 http://www.openwall.com/lists/oss-security/2012/08/20/9 http://www.securelist.com/en/advisories/50279 https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 39EXPL: 1CVE-2012-3507
https://notcve.org/view.php?id=CVE-2012-3507
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzandos (XSS) en program/steps/mail/func.inc en Roundcube Webmail v0.8.0, cuando se usa el aspecto Larry, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del asunto de un mensaje de correo electrónico • http://secunia.com/advisories/50212 http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0 http://trac.roundcube.net/ticket/1488519 http://www.openwall.com/lists/oss-security/2012/08/20/2 http://www.openwall.com/lists/oss-security/2012/08/20/3 http://www.openwall.com/lists/oss-security/2012/08/20/9 http://www.securelist.com/en/advisories/50212 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 1CVE-2012-4668 – Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4668
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Roundcube Webmail v0.8.1 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la firma en un correo electrónico. • https://www.exploit-db.com/exploits/20549 http://sourceforge.net/news/?group_id=139281&id=309011 http://trac.roundcube.net/ticket/1488613 http://www.openwall.com/lists/oss-security/2012/08/20/2 http://www.openwall.com/lists/oss-security/2012/08/20/9 https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 28EXPL: 0CVE-2012-1253
https://notcve.org/view.php?id=CVE-2012-1253
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anteriores a v0.7, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores que implican una imagen embebida adjunta. • http://jvn.jp/en/jp/JVN21422837/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000050 http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •