Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
Max CVSS
6.1
EPSS Score
0.10%
Published
2023-11-06
Updated
2023-12-28

CVE-2023-43770

Known exploited
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
Max CVSS
6.1
EPSS Score
11.47%
Published
2023-09-22
Updated
2024-02-13
CISA KEV Added
2024-02-12

CVE-2023-5631

Known exploited
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Max CVSS
6.1
EPSS Score
0.68%
Published
2023-10-18
Updated
2023-12-22
CISA KEV Added
2023-10-26
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
Max CVSS
6.1
EPSS Score
0.22%
Published
2022-01-06
Updated
2022-04-01

CVE-2021-44026

Known exploited
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Max CVSS
9.8
EPSS Score
0.84%
Published
2021-11-19
Updated
2021-12-16
CISA KEV Added
2023-06-22
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
Max CVSS
6.1
EPSS Score
0.13%
Published
2021-11-19
Updated
2021-12-16
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
Max CVSS
5.4
EPSS Score
0.10%
Published
2021-02-09
Updated
2022-03-10

CVE-2020-35730

Known exploited
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Max CVSS
6.1
EPSS Score
0.46%
Published
2020-12-28
Updated
2022-04-24
CISA KEV Added
2023-06-22
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
Max CVSS
5.4
EPSS Score
0.12%
Published
2021-06-24
Updated
2022-03-10
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
Max CVSS
5.4
EPSS Score
0.12%
Published
2021-06-24
Updated
2022-03-10
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
Max CVSS
6.1
EPSS Score
0.12%
Published
2020-08-12
Updated
2023-01-20
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
Max CVSS
6.1
EPSS Score
0.67%
Published
2020-07-06
Updated
2023-01-20
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Max CVSS
6.1
EPSS Score
0.34%
Published
2020-06-09
Updated
2020-07-23
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
Max CVSS
6.1
EPSS Score
4.15%
Published
2020-06-09
Updated
2023-03-03

CVE-2020-12641

Known exploited
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Max CVSS
9.8
EPSS Score
7.66%
Published
2020-05-04
Updated
2022-04-29
CISA KEV Added
2023-06-22
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
Max CVSS
9.8
EPSS Score
1.16%
Published
2020-05-04
Updated
2022-09-02
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
Max CVSS
6.5
EPSS Score
2.00%
Published
2020-05-04
Updated
2022-09-02
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
Max CVSS
6.1
EPSS Score
0.44%
Published
2020-05-04
Updated
2022-09-02
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
Max CVSS
7.4
EPSS Score
0.12%
Published
2019-08-20
Updated
2023-03-08
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Max CVSS
4.3
EPSS Score
0.19%
Published
2019-04-07
Updated
2022-05-03
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
Max CVSS
7.5
EPSS Score
0.60%
Published
2018-03-13
Updated
2019-10-03
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
Max CVSS
6.1
EPSS Score
67.61%
Published
2018-11-12
Updated
2022-03-10
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
Max CVSS
7.5
EPSS Score
0.21%
Published
2018-11-12
Updated
2022-03-10
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
Max CVSS
8.8
EPSS Score
40.80%
Published
2018-04-07
Updated
2018-05-24
** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification.
Max CVSS
5.9
EPSS Score
0.84%
Published
2018-05-16
Updated
2019-10-03
65 vulnerabilities found
1 2 3
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!