Page 6 of 43 results (0.001 seconds)

CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-2180

https://notcve.org/view.php?id=CVE-2015-2180

The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. El controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permite a atacantes remotos ejecutar comandos arbitrarios a través de los metacaracteres de shell en la contraseña. • http://www.securityfocus.com/bid/96387 https://github.com/roundcube/roundcubemail/issues/4757 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-2181

https://notcve.org/view.php?id=CVE-2015-2181

Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. Varios desbordamientos de búfer en el controlador DBMail en el complemento Password de Roundcube en versiones anteriores a 1.1.0 permiten a atacantes remotos tener un impacto no especificado a través de (1) la contraseña o (2) el nombre de usuario. • http://www.securityfocus.com/bid/96391 https://github.com/roundcube/roundcubemail/issues/4757 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2

CVE-2016-9920

https://notcve.org/view.php?id=CVE-2016-9920

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. steps/mail/sendmail.inc en Roundcube en versiones anteriores a 1.1.7 y 1.2.x en versiones anteriores a 1.2.3, cuando ningún servidor SMTP está configurado y el programa sendmail está habilitado, no restringe adecuadamente el uso de direcciones personalizadas envelope-from en la línea de comando de sendmail, lo que permite a usuarios remotos autenticados ejecutar código arbitrario a través de una petición HTTP modificada que envía un mensaje de correo electrónico manipulado. • https://github.com/t0kx/exploit-CVE-2016-9920 http://www.openwall.com/lists/oss-security/2016/12/08/10 http://www.securityfocus.com/bid/94858 https://blog.ripstech.com/2016/roundcube-command-execution-via-email https://roundcube.net/news/2016/11/28/updates-1.2.3-and-1.1.7-released https://security.gentoo.org/glsa/201612-44 • CWE-284: Improper Access Control •

CVSS: 8.8EPSS: 11%CPEs: 2EXPL: 0

CVE-2016-4069

https://notcve.org/view.php?id=CVE-2016-4069

Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. Vulnerabilidad de CSRF en Roundcube Webmail en versiones anteriores a1.1.5 permite a atacantes remotos secuestrar la autenticación de usuarios para peticiones que descargan archivos adjuntos y provocar una denegación del servicio (consumo del disco) a través de vectores no especificados. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html http://www.openwall.com/lists/oss-security/2016/04/23/4 http://www.securityfocus.com/bid/92654 https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 https://github.com/roundcube/roundcubemail/issues/4957 https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 https://github.com/roundcube/roundcubemail/wiki/Changelog#release- • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2015-8793

https://notcve.org/view.php?id=CVE-2015-8793

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937. Vulnerabilidad de XSS en program/include/rcmail.php en Roundcube en versiones anteriores a 1.0.6 y 1.1.x en versiones anteriores a 1.1.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro _mbox en una tarea correo a la URL por defecto, una vulnerabilidad diferente a CVE-2011-2937. • http://trac.roundcube.net/ticket/1490417 http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.2 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •