CVE-2018-19206
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
- Update to 1.3.6+dfsg.1-1ubuntu0.1~esm7
Published Updated
PatchFirst · Latest vulnerabilities
roundcube vulnerabilities · Page 5
Vulnerabilities published for roundcube in the last 30 days: 23. Listed in the KEV catalogue: 0.
Vulnerabilities: 83
CVE-2018-19205
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
- Update to 1.3.6+dfsg.1-1ubuntu0.1~esm7
Published UpdatedCVE-2018-1000071
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
- Update to 1.3.6+dfsg.1-1ubuntu0.1~esm7
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.