3 results (0.009 seconds)

CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2015-5382

https://notcve.org/view.php?id=CVE-2015-5382

23 May 2017 — program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard. program/steps/addressbook/photo.inc en Roundcube Webmail, en versiones anteriores a la 1.0.6 y 1.1.x anteriores a la 1.1.2, permitiría a usuarios remotos autenticados leer ficheros arbitrarios a través del parámetro _alt parameter cuando cargamos una vCard. • http://www.openwall.com/lists/oss-security/2015/07/07/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-8794

https://notcve.org/view.php?id=CVE-2015-8794

29 Jan 2016 — Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling. Vulnerabilidad de salto de ruta absoluta en program/steps/addressbook/photo.inc en Roundcube en versiones anteriores a 1.0.6 y 1.1.x en versiones anteriores a 1.1.2 permite a usuarios remotos autenticados leer archivos arbitrarios a través de un nomb... • http://trac.roundcube.net/changeset/6ccd4c54b/github • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.5EPSS: 17%CPEs: 5EXPL: 4

CVE-2015-8770 – Roundcube Webmail 1.1.3 - Directory Traversal

https://notcve.org/view.php?id=CVE-2015-8770

15 Jan 2016 — Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php. Vulnerabilidad de salto de directorio en la función set_skin en program/include/rcmail_output_html.php en Roundcube en versiones anteriores a 1.0.8 y 1.1.x en versiones anteriores a 1.1.4 ... • https://packetstorm.news/files/id/135274 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •