CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2019-10740
https://notcve.org/view.php?id=CVE-2019-10740
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. En Roundcube Webmail en versiones anteriores a la 1.3.10, un atacante en posesión de correos electrónicos cifrados S/MIME o PGP puede envolverlos como subparte dentro de un correo electrónico multiparte diseñado. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html https://github.com/roundcube/roundcubemail/issues/6638 https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9558 – Mailtraq WebMail 2.17.7.3550 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2019-9558
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe. Mailtraq WebMail, en su versión 2.17.7.3550, tiene Cross-Site Scripting (XSS) persistente mediante el cuerpo del correo electrónico. Para explotar la vulnerabilidad, la víctima deberá abrir un correo electrónico con JavaScript malicioso que se inserta en el cuerpo del correo electrónico como un iframe. Mailtraq WebMail version 2.17.7.3550 suffers from a persistent cross site scripting vulnerability. • https://packetstormsecurity.com/files/151957/Mailtraq-WebMail-2.17.7.3550-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 47%CPEs: 2EXPL: 0CVE-2018-19206
https://notcve.org/view.php?id=CVE-2018-19206
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment. steps/mail/func.inc en Roundcube en versiones anteriores a la 1.3.8 tiene Cross-Site Scripting (XSS) mediante el uso manipulado de • https://github.com/roundcube/roundcubemail/releases/tag/1.3.8 https://roundcube.net/news/2018/10/26/update-1.3.8-released https://www.debian.org/security/2018/dsa-4344 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-19205
https://notcve.org/view.php?id=CVE-2018-19205
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php. Roundcube en versiones anteriores a la 1.3.7 gestiona de manera incorrecta las advertencias de integridad/protección GnuPG MDC, lo que facilita que los atacantes obtengan información sensible. Esto está relacionado con CVE-2017-17688. Esto está asociado con plugins/enigma/lib/enigma_driver_gnupg.php. • https://github.com/roundcube/roundcubemail/releases/tag/1.3.7 https://roundcube.net/news/2018/07/27/update-1.3.7-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 40%CPEs: 2EXPL: 0CVE-2018-9846
https://notcve.org/view.php?id=CVE-2018-9846
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism. En Roundcube, de las versiones 1.2.0 a 1.3.5, con el plugin archive habilitado y configurado, es posible explotar el parámetro controlado por el usuario "_uid" no saneado (en una petición _task=mail_mbox=INBOX_action=plugin.move2archive en archive.php) para realizar un ataque de inyección MX (IMAP) mediante la colocación de un comando IMAP después de una secuencia %0d%0a. NOTA: hay menos posibilidades de explotación en las versiones 1.3.4 y posteriores debido al mecanismo de protección Same Origin Policy. • https://github.com/roundcube/roundcubemail/issues/6229 https://github.com/roundcube/roundcubemail/issues/6238 https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a https://www.debian.org/security/2018/dsa-4181 • CWE-20: Improper Input Validation •