CVE-2024-37384
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm4
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de roundcube · Page n° 4
Vulnérabilités publiées pour roundcube au cours des 30 derniers jours : 23. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 83
CVE-2023-43770
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm3
Publication Mise à jourCVE-2021-44025
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2021-44026
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-35730
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-13964
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-13965
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-12640
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-12641
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-12625
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2020-12626
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm2
Publication Mise à jourCVE-2019-15237
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm8
Publication Mise à jourCVE-2019-10740
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2018-19206
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2018-19205
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2018-9846
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2018-1000071
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm5
Publication Mise à jourCVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jourCVE-2016-4068
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
- Mettez à jour vers 1.2~beta+dfsg.1-0ubuntu1+esm7
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.