steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
Max CVSS
7.5
EPSS Score
2.67%
Published
2013-11-05
Updated
2014-03-26
Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group.
Max CVSS
3.5
EPSS Score
0.07%
Published
2013-08-29
Updated
2013-08-29
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
Max CVSS
4.3
EPSS Score
0.38%
Published
2013-08-29
Updated
2013-09-12
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
Max CVSS
4.3
EPSS Score
0.27%
Published
2013-02-24
Updated
2015-08-24
4 vulnerabilities found