CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0413
https://notcve.org/view.php?id=CVE-2009-0413
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en RoundCube Webmail (roundcubemail) v0.2 stable, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través de un atributo oculto incrustado en un correo electrónico HTML. • http://secunia.com/advisories/33622 http://secunia.com/advisories/33827 http://trac.roundcube.net/changeset/2245 http://www.securityfocus.com/bid/33372 http://www.vupen.com/english/advisories/2009/0192 https://exchange.xforce.ibmcloud.com/vulnerabilities/48129 https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 86%CPEs: 2EXPL: 4CVE-2008-5619 – Roundcube Webmail 0.2-3 Beta - Code Execution
https://notcve.org/view.php?id=CVE-2008-5619
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch. html2text.php en Chuggnutt HTML a Text Converter, como se usa en PHPMailer en versiones anteriores a 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha y 0.2-3.beta, Mahara y AtMail Open 1.03, permite a atacantes remotos ejecutar código arbitrario a través de entrada manipulada que se procesa por la función preg_replace con el interruptor de eval. RoundCube Webmail versions 0.2-3 Beta and below suffer from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/7549 https://www.exploit-db.com/exploits/7553 http://mahara.org/interaction/forum/topic.php?id=533 http://osvdb.org/53893 http://secunia.com/advisories/33145 http://secunia.com/advisories/33170 http://secunia.com/advisories/34789 http://sourceforge.net/forum/forum.php?forum_id=898542 http://trac.roundcube.net/changeset/2148 http://trac.roundcube.net/ticket/1485618 http://www.openwall.com/lists/oss-security/2008/12/12/1 http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2008-5620
https://notcve.org/view.php?id=CVE-2008-5620
RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image. RoundCube Webmail (roundcubemail) antes de la v0.2-beta permite a atacantes remotos producir una denegación de servicio (agotamiento de memoria) a través de parámetros de tamaño manipulados que son usado para crear una imagen de cuota grande. • http://sourceforge.net/forum/forum.php?forum_id=898542 http://www.vupen.com/english/advisories/2008/3418 https://exchange.xforce.ibmcloud.com/vulnerabilities/47550 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 5CVE-2007-6321 – Roundcube Webmail 0.1 - CSS Expression Input Validation
https://notcve.org/view.php?id=CVE-2007-6321
Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en RoundCube webmail 0.1rc2, 2007-12-09, y versiones anteriores, cuando utiliza Internet Explorer, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de expresión que contiene los comandos. • https://www.exploit-db.com/exploits/30877 http://openmya.hacker.jp/hasegawa/security/expression.txt http://secunia.com/advisories/30734 http://securityreason.com/securityalert/3435 http://trac.roundcube.net/ticket/1484701 http://www.securityfocus.com/archive/1/484802/100/0/threaded http://www.securityfocus.com/bid/26800 https://exchange.xforce.ibmcloud.com/vulnerabilities/38981 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2005-4368
https://notcve.org/view.php?id=CVE-2005-4368
roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message. • http://www.securityfocus.com/archive/1/418851/100/0/threaded http://www.securityfocus.com/archive/1/419710/100/0/threaded http://www.securityfocus.com/archive/1/422168/100/0/threaded • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •