Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
roundcube roundcube vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2011-2937
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail prior to 0.5.4 allows remote malicious users to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Roundcube Webmail 0.4.1
Roundcube Webmail 0.2
Roundcube Webmail 0.1
Roundcube Webmail 0.1.1
Roundcube Webmail
Roundcube Webmail 0.3.1
Roundcube Webmail 0.3
Roundcube Webmail 0.5
Roundcube Webmail 0.4
Roundcube Webmail 0.2.1
Roundcube Webmail 0.4.2
Roundcube Webmail 0.5.2
Roundcube Webmail 0.5.1
NA
CVE-2011-1491
The login form in Roundcube Webmail prior to 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's accou...
Roundcube Webmail 0.1.1
Roundcube Webmail 0.1
Roundcube Webmail 0.2
Roundcube Webmail 0.4.1
Roundcube Webmail 0.4.2
Roundcube Webmail 0.2.1
Roundcube Webmail 0.4
Roundcube Webmail 0.3
Roundcube Webmail 0.3.1
Roundcube Webmail 0.5
Roundcube Webmail
NA
CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail prior to 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server...
Roundcube Webmail 0.1
Roundcube Webmail 0.3
Roundcube Webmail 0.4
Roundcube Webmail 0.1.1
Roundcube Webmail 0.2
Roundcube Webmail 0.4.2
Roundcube Webmail 0.5
Roundcube Webmail 0.2.1
Roundcube Webmail 0.4.1
Roundcube Webmail 0.3.1
Roundcube Webmail
6.5
CVSSv3
CVE-2015-5382
program/steps/addressbook/photo.inc in Roundcube Webmail prior to 1.0.6 and 1.1.x prior to 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Roundcube Roundcube Webmail
Roundcube Roundcube Webmail 1.1.1
Roundcube Webmail 1.1
NA
CVE-2010-0464
Roundcube 0.3.1 and previous versions does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote malicious users to determine the network location of the webmail user by logging DNS requests.
Roundcube Webmail 0.1
Roundcube Webmail 0.2.1
Roundcube Webmail 0.3
Roundcube Webmail 0.1.1
Roundcube Webmail 0.2
Roundcube Webmail
Roundcube Webmail 0.2.2
6.1
CVSSv3
CVE-2016-4068
Cross-site scripting (XSS) vulnerability in Roundcube Webmail prior to 1.0.9 and 1.1.x prior to 1.1.5 allows remote malicious users to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
Opensuse Opensuse 13.1
Opensuse Opensuse 13.2
Opensuse Leap 42.1
Roundcube Roundcube Webmail 1.1.1
Roundcube Webmail 1.1.4
Roundcube Webmail
Roundcube Roundcube Webmail 1.1.2
Roundcube Webmail 1.1
Roundcube Roundcube Webmail 1.1.3
6.1
CVSSv3
CVE-2015-8864
Cross-site scripting (XSS) vulnerability in Roundcube Webmail prior to 1.0.9 and 1.1.x prior to 1.1.5 allows remote malicious users to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Opensuse Opensuse 13.2
Opensuse Leap 42.1
Opensuse Opensuse 13.1
Roundcube Webmail 1.1
Roundcube Webmail
Roundcube Webmail 1.1.4
Roundcube Roundcube Webmail 1.1.3
Roundcube Roundcube Webmail 1.1.2
Roundcube Roundcube Webmail 1.1.1
7.8
CVSSv3
CVE-2017-16651
Roundcube Webmail prior to 1.1.10, 1.2.x prior to 1.2.7, and 1.3.x prior to 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at th...
Roundcube Webmail 1.3.0
Roundcube Webmail 1.2.5
Roundcube Webmail
Roundcube Webmail 1.3.2
Roundcube Webmail 1.2.3
Roundcube Webmail 1.2.2
Roundcube Webmail 1.2.1
Roundcube Webmail 1.2.0
Roundcube Webmail 1.3.1
Roundcube Webmail 1.2.6
Roundcube Webmail 1.2.4
Debian Debian Linux 9.0
Debian Debian Linux 7.0
2 Github repositories
6.1
CVSSv3
CVE-2017-6820
rcube_utils.php in Roundcube prior to 1.1.8 and 1.2.x prior to 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.
Roundcube Webmail
Roundcube Webmail 1.2.3
Roundcube Webmail 1.2.2
Roundcube Webmail 1.2.1
Roundcube Webmail 1.2.0
NA
CVE-2009-4076
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and previous versions allows remote malicious users to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2...
Roundcube Webmail 0.1
Roundcube Webmail 0.1.1
Roundcube Webmail 0.2
Roundcube Webmail 0.2.1
Roundcube Webmail
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895
blind SQL injection
CVE-2024-5064
CVE-2023-52677
CVE-2023-52682
CVE-2024-30051
CVE-2024-35849
remote attackers
remote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »