Page 4 of 57 results (0.003 seconds)

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2015-8793

https://notcve.org/view.php?id=CVE-2015-8793

29 Jan 2016 — Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937. Vulnerabilidad de XSS en program/include/rcmail.php en Roundcube en versiones anteriores a 1.0.6 y 1.1.x en versiones anteriores a 1.1.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a t... • http://trac.roundcube.net/ticket/1490417 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2015-8105

https://notcve.org/view.php?id=CVE-2015-8105

10 Nov 2015 — Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload. Vulnerabilidad de XSS en program/js/app.js en Roundcube webmail en versiones anteriores a 1.0.7 y 1.1.x en versiones anteriores a 1.1.3 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del nombre de archivo en una sub... • http://lists.opensuse.org/opensuse-updates/2015-11/msg00030.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 1

CVE-2015-1433

https://notcve.org/view.php?id=CVE-2015-1433

03 Feb 2015 — program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email. program/lib/Roundcube/rcube_washtml.php en Roundcube anterior a 1.0.5 no cita correctamente las cadenas, lo que permite a atacantes remotos realizar ataques de XSS a través del atributo de estilo en un email. • http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 0

CVE-2014-9587

https://notcve.org/view.php?id=CVE-2014-9587

15 Jan 2015 — Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins. Múltiples vulnerabilidades de CSRF en Roundcube Webmail anterior a 1.0.4 permite a atacantes remotos secuestrar la autenticación de victimas no especificadas a través de vectores no especificadas, relacionado con (1) operaciones del libro de... • http://roundcube.net/news/2014/12/18/update-1.0.4-released • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.8EPSS: 1%CPEs: 54EXPL: 0

CVE-2013-6172 – Mandriva Linux Security Advisory 2013-263

https://notcve.org/view.php?id=CVE-2013-6172

28 Oct 2013 — steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code. steps/utils/save_pref.inc en Roundcube webmail anterior a la versión 0.8.7 y 0.9.x anterior a 0.9.5 permite a atacantes remotos modificar las opciones de configuración a través del parámetro _session, que se puede aprovechar para leer ar... • http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.4EPSS: 0%CPEs: 52EXPL: 3

CVE-2013-5645 – Mandriva Linux Security Advisory 2013-226

https://notcve.org/view.php?id=CVE-2013-5645

18 Jul 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. Múltiples vulnerabilidades de cross-site scripting (XSS) en Roundcube webmail anterior a v0.9.3, permite a atacantes remoto... • https://packetstorm.news/files/id/122462 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0

CVE-2013-1904 – Mandriva Linux Security Advisory 2013-148

https://notcve.org/view.php?id=CVE-2013-1904

22 Apr 2013 — Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013. Vulnerabilidad de recorrido de directorio absoluto en steps/mail/sendmail.inc en Roundcube Webmail anterior a 0.7.3 y 0.8.x anterior a 0.8.6 permite a atacantes remotos leer archivos ... • http://habrahabr.ru/post/174423 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 38EXPL: 0

CVE-2012-6121

https://notcve.org/view.php?id=CVE-2012-6121

24 Feb 2013 — Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Roundcube Webmail anterior a v0.8.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del enlace (1) data:text o (2) vbscript. • http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 5%CPEs: 34EXPL: 1

CVE-2012-4668 – Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-4668

25 Aug 2012 — Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Roundcube Webmail v0.8.1 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la firma en un correo electrónico. Cross-site scripting vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inje... • https://www.exploit-db.com/exploits/20549 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 39EXPL: 1

CVE-2012-3507

https://notcve.org/view.php?id=CVE-2012-3507

25 Aug 2012 — Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzandos (XSS) en program/steps/mail/func.inc en Roundcube Webmail v0.8.0, cuando se usa el aspecto Larry, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del asunto de un mensaje de corr... • http://secunia.com/advisories/50212 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •