Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
142 results · page 2 of 3
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35542 · Email & office · reported by MITREMedium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35541 · Email & office · reported by MITREMedium 4.2
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14.CVE-2026-35540 · Email & office · reported by MITREMedium 5.4
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35539 · Email & office · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35538 · Email & office · reported by MITRELow 3.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.CVE-2026-35537 · Email & office · reported by MITRELow 3.7
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.CVE-2026-26079 · Email & office · reported by MITREMedium 4.7
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.CVE-2026-25916 · Email & office · reported by MITREMedium 4.3
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnews.ycombinator.com
Dec 18, 2025RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
- Product
- Webmail
- On CISA’s list since
- Feb 20, 2026 (federal fix deadline Mar 13, 2026)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comroundcube.net
Dec 18, 2025Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.CVE-2025-68460 · Email & office · reported by MITREHigh 7.2
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Jun 2, 2025RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.9
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
- Product
- Webmail
- On CISA’s list since
- Feb 20, 2026 (federal fix deadline Mar 13, 2026)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfearsoff.orggithub.com
Feb 3, 2025Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadingCVE-2024-57004 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messageCVE-2024-42010 · Websites & servers · roundcube · reported by MITREHigh 7.5
mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
- Product
- roundcube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024RoundCube Webmail Cross-Site Scripting VulnerabilityCVE-2024-42009 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.3
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- Product
- Webmail
- On CISA’s list since
- Jun 9, 2025 (federal fix deadline Jun 30, 2025)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Aug 5, 2024A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and sCVE-2024-42008 · Websites & servers · Roundcube · reported by MITRECritical 9.3
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.CVE-2024-37385 · Websites & servers · roundcube · reported by MITRECritical 9.8
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
- Product
- roundcube_webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.CVE-2024-37384 · Websites & servers · roundcube · reported by MITREMedium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
- Product
- roundcube_webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2024RoundCube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2024-37383 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
- Product
- Webmail
- On CISA’s list since
- Oct 24, 2024 (federal fix deadline Nov 14, 2024)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Nov 5, 2023Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).CVE-2023-47272 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-5631 · Websites & servers · Roundcube · reported by security@eset.comExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
- Product
- Webmail
- On CISA’s list since
- Oct 26, 2023 (federal fix deadline Nov 16, 2023)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogopenwall.comopenwall.com
Sep 22, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-43770 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
- Product
- Webmail
- On CISA’s list since
- Feb 12, 2024 (federal fix deadline Mar 4, 2024)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comlists.debian.org
Sep 4, 2023Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change anCVE-2023-3222 · Other software · AlfnRU · reported by cve-coordination@incibe.esHigh 7.5
Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.
- Product
- Password Recovery Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2023User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the paCVE-2023-3221 · Other software · AlfnRU · reported by cve-coordination@incibe.esMedium 5.3
User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database.
- Product
- Password Recovery Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.CVE-2021-46144 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Product
- Roundcube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Nov 18, 2021Roundcube Webmail SQL Injection VulnerabilityCVE-2021-44026 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
- Product
- Roundcube Webmail
- On CISA’s list since
- Jun 22, 2023 (federal fix deadline Jul 13, 2023)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogbugs.debian.orggithub.com
Nov 18, 2021Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.CVE-2021-44025 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.CVE-2020-18671 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.CVE-2020-18670 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2021Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.CVE-2021-26925 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 28, 2020Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-35730 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
- Product
- Roundcube Webmail
- On CISA’s list since
- Jun 22, 2023 (federal fix deadline Jul 13, 2023)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogbugs.debian.orggithub.com
Aug 12, 2020Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document.CVE-2020-16145 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jul 6, 2020An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7.CVE-2020-15562 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jun 8, 2020Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-13965 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
- Product
- Webmail
- On CISA’s list since
- Jun 26, 2024 (federal fix deadline Jul 17, 2024)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jun 8, 2020An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.CVE-2020-13964 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2020Roundcube Webmail Remote Code Execution VulnerabilityCVE-2020-12641 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
- Product
- Roundcube Webmail
- On CISA’s list since
- Jun 22, 2023 (federal fix deadline Jul 13, 2023)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloglists.opensuse.orggithub.com
May 4, 2020Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.CVE-2020-12640 · Websites & servers · Roundcube · reported by MITRECritical 9.8
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
May 3, 2020An issue was discovered in Roundcube Webmail before 1.4.4.CVE-2020-12626 · Websites & servers · Roundcube · reported by MITREMedium 6.5
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2020An issue was discovered in Roundcube Webmail before 1.4.4.CVE-2020-12625 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Aug 19, 2019Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.CVE-2019-15237 · Websites & servers · Roundcube · reported by MITREHigh 7.4
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 5, 2019cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).CVE-2016-10770 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Aug 2, 2019cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).CVE-2017-18450 · Websites & servers · Cpanel · reported by MITREMedium 4.5
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).CVE-2017-18449 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).CVE-2017-18416 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).CVE-2016-10846 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Jun 24, 2019The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffectiveCVE-2019-12938 · Other software · Analogic · reported by MITREMedium 4.3
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.
- Product
- Poste.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2019In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-10740 · Websites & servers · Roundcube · reported by MITREMedium 4.3
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Nov 12, 2018steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML CVE-2018-19206 · Websites & servers · Roundcube · reported by MITREMedium 6.1
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Nov 12, 2018Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue CVE-2018-19205 · Websites & servers · Roundcube · reported by MITREHigh 7.5
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Sep 9, 2018In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).CVE-2018-16736 · Other software · Rcfilters Project · reported by MITREMedium 5.4
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
- Product
- Rcfilters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2018In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" paraCVE-2018-9846 · Websites & servers · Roundcube · reported by MITREHigh 8.8
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.