8 results (0.018 seconds)

CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0

Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences. Roundcube versiones anteriores a 1.4.13 y versiones 1.5.x anteriores a 1.5.2, permite una vulnerabilidad de tipo XSS por medio de un mensaje de correo electrónico HTML con secuencias de tokens de hojas de estilo en cascada (CSS) diseñadas. • https://bugs.debian.org/1003027 https://github.com/roundcube/roundcubemail/commit/8894fddd59b770399eed4ef8d4da5773913b5bf0 https://github.com/roundcube/roundcubemail/commit/b2400a4b592e3094b6c84e6000d512f99ae0eed8 https://lists.debian.org/debian-lts-announce/2022/01/msg00005.html https://roundcube.net/news/2021/12/30/security-update-1.4.13-released https://roundcube.net/news/2021/12/30/update-1.5.2-released https://www.debian.org/security/2022/dsa-5037 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory. Roundcube Webmail versiones 1.1.x anteriores a la 1.1.2, permitiría a atacantes remotos obtener información sensible a través de la lectura de ficheros en los directorios (1) config, (2) temp, o (3) logs. • http://www.openwall.com/lists/oss-security/2015/07/07/2 https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39 https://github.com/roundcube/roundcubemail/issues/4816 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard. program/steps/addressbook/photo.inc en Roundcube Webmail, en versiones anteriores a la 1.0.6 y 1.1.x anteriores a la 1.1.2, permitiría a usuarios remotos autenticados leer ficheros arbitrarios a través del parámetro _alt parameter cuando cargamos una vCard. • http://www.openwall.com/lists/oss-security/2015/07/07/2 http://www.openwall.com/lists/oss-security/2015/07/07/3 https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9 https://github.com/roundcube/roundcubemail/issues/4817 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. Vulnerabilidad de tipo Cross-site scripting (XSS) en program/include/rcmail.php en Roundcube Webmail, versiones 1.1.x anteriores a la 1.1.2, que permitiría a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro _mbox en la URI por defecto. • http://trac.roundcube.net/ticket/1490417 http://www.openwall.com/lists/oss-security/2015/07/07/2 https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc https://github.com/roundcube/roundcubemail/issues/4837 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. Vulnerabilidad XSS en Roundcube Webmail en versiones anteriores a 1.0.9 y 1.1.x en versiones anteriores a 1.1.5 permite a atacantes remotos inyectar scripts web o HTML a través de un SVG manipulado, una vulnerabilidad diferente a CVE-2015-8864. • http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218 https://github.com/roundcube/roundcubemail/issues/4949 https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 https://github.com/roundcube/roundcubemail/releases/tag/1.1.5 https://github.com/roundcube • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •