CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2015-5382
https://notcve.org/view.php?id=CVE-2015-5382
23 May 2017 — program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard. program/steps/addressbook/photo.inc en Roundcube Webmail, en versiones anteriores a la 1.0.6 y 1.1.x anteriores a la 1.1.2, permitiría a usuarios remotos autenticados leer ficheros arbitrarios a través del parámetro _alt parameter cuando cargamos una vCard. • http://www.openwall.com/lists/oss-security/2015/07/07/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2015-5383
https://notcve.org/view.php?id=CVE-2015-5383
23 May 2017 — Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory. Roundcube Webmail versiones 1.1.x anteriores a la 1.1.2, permitiría a atacantes remotos obtener información sensible a través de la lectura de ficheros en los directorios (1) config, (2) temp, o (3) logs. • http://www.openwall.com/lists/oss-security/2015/07/07/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2017-8114 – Gentoo Linux Security Advisory 201707-11
https://notcve.org/view.php?id=CVE-2017-8114
29 Apr 2017 — Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Roundcube Webmail permite reinicios de contraseña arbitrarios por usuarios autenticados. Esto afecta a las versiones anteriores a la 1.0.11, entre la 1.1.x y la 1.1.9 y entre la 1.2.x y la 1.2.5. • http://www.securityfocus.com/bid/98445 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2015-8864
https://notcve.org/view.php?id=CVE-2015-8864
13 Apr 2017 — Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068. La vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un SVG manipulado, una vulnerabilidad diferente a CVE-2016-4068. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2016-4068
https://notcve.org/view.php?id=CVE-2016-4068
13 Apr 2017 — Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. Vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar scripts web o HTML a través de un SVG manipulado, una vulnerabilidad diferente a CVE-2015-8864. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6820
https://notcve.org/view.php?id=CVE-2017-6820
12 Mar 2017 — rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. rcube_utils.php en Roundcube en versiones anteriores a 1.1.8 y 1.2.x en versiones anteriores a 1.2.4 es susceptible a una vulnerabilidad de XSS a través una secuencia de tokens de CSS manipulada dentro de un elemento SVG. • http://www.securityfocus.com/bid/96817 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-2181
https://notcve.org/view.php?id=CVE-2015-2181
30 Jan 2017 — Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. Varios desbordamientos de búfer en el controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permiten a atacantes remotos tener un impacto no especificado a través de (1) la contraseña o (2) el nombre de usuario. • http://www.securityfocus.com/bid/96391 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 1CVE-2015-2180
https://notcve.org/view.php?id=CVE-2015-2180
30 Jan 2017 — The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. El controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permite a atacantes remotos ejecutar comandos arbitrarios a través de los metacaracteres de shell en la contraseña. • http://www.securityfocus.com/bid/96387 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-4552
https://notcve.org/view.php?id=CVE-2016-4552
20 Dec 2016 — Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message. Vulnerabilidad de XSS en Roundcube Webmail en versiones anteriores a 1.2.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del atributo href en una etiqueta de área en un mensaje de e-mail. • http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 38%CPEs: 4EXPL: 2CVE-2016-9920 – Gentoo Linux Security Advisory 201612-44
https://notcve.org/view.php?id=CVE-2016-9920
08 Dec 2016 — steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. steps/mail/sendmail.inc en Roundcube en versiones anteriores a 1.1.7 y 1.2.x en versiones anteriores a 1.2.3, cuando ningún servidor SMTP... • https://github.com/t0kx/exploit-CVE-2016-9920 • CWE-284: Improper Access Control •