CVSS: 7.8EPSS: 1%CPEs: 13EXPL: 3CVE-2017-16651 – Roundcube Webmail File Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. Roundcube Webmail, en versiones anteriores a la 1.1.10, versiones 1.2.x anteriores a la 1.2.7 y y versiones 1.3.x anteriores a la 1.3.3, permite el acceso no autorizado a archivos arbitrarios en el sistema de archivos del host, incluyendo archivos de configuración, tal y como se explotó en Noviembre 2017 pero sin publicar ninguna prueba de concepto oficial. El atacante debe ser capaz de autenticarse en el sistema objetivo con un nombre de usuario y una contraseña válidos, ya que el ataque necesita una sesión activa. • https://github.com/ropbear/CVE-2017-16651 https://github.com/sephiroth950911/CVE-2017-16651-Exploit http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html http://www.securityfocus.com/bid/101793 https://github.com/roundcube/roundcubemail/issues/6026 https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://lists.debian. • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2017-8114
https://notcve.org/view.php?id=CVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Roundcube Webmail permite reinicios de contraseña arbitrarios por usuarios autenticados. Esto afecta a las versiones anteriores a la 1.0.11, entre la 1.1.x y la 1.1.9 y entre la 1.2.x y la 1.2.5. • http://www.securityfocus.com/bid/98445 https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 https://security.gentoo.org/glsa/201707-11 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2016-4068
https://notcve.org/view.php?id=CVE-2016-4068
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. Vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar scripts web o HTML a través de un SVG manipulado, una vulnerabilidad diferente a CVE-2015-8864. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218 https://github.com/roundcube/roundcubemail/issues/4949 https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 https://github.com/roundcube • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2015-8864
https://notcve.org/view.php?id=CVE-2015-8864
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068. La vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un SVG manipulado, una vulnerabilidad diferente a CVE-2016-4068. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18 https://github.com/roundcube/roundcubemail/issues/4949 https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 https://github.com/roundcube/roundcubemail/wiki&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6820
https://notcve.org/view.php?id=CVE-2017-6820
rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. rcube_utils.php en Roundcube en versiones anteriores a 1.1.8 y 1.2.x en versiones anteriores a 1.2.4 es susceptible a una vulnerabilidad de XSS a través una secuencia de tokens de CSS manipulada dentro de un elemento SVG. • http://www.securityfocus.com/bid/96817 https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db00d28ecc1554e9f4 https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797feb47652482c8305 https://github.com/roundcube/roundcubemail/releases/tag/1.1.8 https://github.com/roundcube/roundcubemail/releases/tag/1.2.4 https://github.com/roundcube/roundcubemail/wiki/Changelog#release-124 https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •