CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0413
https://notcve.org/view.php?id=CVE-2009-0413
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en RoundCube Webmail (roundcubemail) v0.2 stable, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través de un atributo oculto incrustado en un correo electrónico HTML. • http://secunia.com/advisories/33622 http://secunia.com/advisories/33827 http://trac.roundcube.net/changeset/2245 http://www.securityfocus.com/bid/33372 http://www.vupen.com/english/advisories/2009/0192 https://exchange.xforce.ibmcloud.com/vulnerabilities/48129 https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 86%CPEs: 2EXPL: 4CVE-2008-5619 – Roundcube Webmail 0.2-3 Beta - Code Execution
https://notcve.org/view.php?id=CVE-2008-5619
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch. html2text.php en Chuggnutt HTML a Text Converter, como se usa en PHPMailer en versiones anteriores a 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha y 0.2-3.beta, Mahara y AtMail Open 1.03, permite a atacantes remotos ejecutar código arbitrario a través de entrada manipulada que se procesa por la función preg_replace con el interruptor de eval. RoundCube Webmail versions 0.2-3 Beta and below suffer from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/7549 https://www.exploit-db.com/exploits/7553 http://mahara.org/interaction/forum/topic.php?id=533 http://osvdb.org/53893 http://secunia.com/advisories/33145 http://secunia.com/advisories/33170 http://secunia.com/advisories/34789 http://sourceforge.net/forum/forum.php?forum_id=898542 http://trac.roundcube.net/changeset/2148 http://trac.roundcube.net/ticket/1485618 http://www.openwall.com/lists/oss-security/2008/12/12/1 http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2008-5620
https://notcve.org/view.php?id=CVE-2008-5620
RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image. RoundCube Webmail (roundcubemail) antes de la v0.2-beta permite a atacantes remotos producir una denegación de servicio (agotamiento de memoria) a través de parámetros de tamaño manipulados que son usado para crear una imagen de cuota grande. • http://sourceforge.net/forum/forum.php?forum_id=898542 http://www.vupen.com/english/advisories/2008/3418 https://exchange.xforce.ibmcloud.com/vulnerabilities/47550 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 91%CPEs: 25EXPL: 2CVE-2008-1055 – Surgemail and WebMail 3.0 - 'Page' Remote Format String
https://notcve.org/view.php?id=CVE-2008-1055
Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter. Vulnerabilidad de cadena de formato en webmail.exe de NetWin SurgeMail 38k4 y versiones anteriores y beta 39a, y WebMail 3.1s y versiones anteriores, permite a atacantes remotos provocar una denegación de servicio (caída del demonio) y posiblemente ejecutar código de su elección a través de cadenas de formato especificadas en el parámetro page. • https://www.exploit-db.com/exploits/31300 http://aluigi.altervista.org/adv/surgemailz-adv.txt http://secunia.com/advisories/29105 http://secunia.com/advisories/29137 http://securityreason.com/securityalert/3705 http://www.securityfocus.com/archive/1/488741/100/0/threaded http://www.securityfocus.com/bid/27990 http://www.securitytracker.com/id?1019500 http://www.vupen.com/english/advisories/2008/0678 https://exchange.xforce.ibmcloud.com/vulnerabilities/40833 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 2CVE-2008-0210 – Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure
https://notcve.org/view.php?id=CVE-2008-0210
Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests, which allows remote attackers to bypass authentication via a sess[auth]=1 parameter settting. NOTE: this can be leveraged to conduct directory traversal attacks without authentication by using CVE-2008-0140. Uebimiau Webmail 2.7.10 y 2.7.2 no protege variables de estado de autenticación de ser establecidas mediante peticiones HTTP, lo cual permite a atacantes remotos evitar la autenticación mediante el parámetro de configuración sess[auth]=1. NOTA: esto podría ser aprovechado para llevar a cabo ataques de salto de directorio sin autenticación utilizando CVE-2008-0140. • https://www.exploit-db.com/exploits/4846 http://www.securityfocus.com/bid/27154 • CWE-287: Improper Authentication •