Roundcube Webmail 1.4 Release Candidate 2

CPE Details

Roundcube Webmail 1.4 Release Candidate 2
roundcube
webmail
1.4
2022-03-10
13h08 +00:00
2022-03-10
13h34 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:roundcube:webmail:1.4:rc2:*:*:*:*:*:*

Informations

Vendor

roundcube

Product

webmail

Version

1.4

Update

rc2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-42008 2024-08-05 00h00 +00:00 A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
9.3
Critique
CVE-2024-42009 2024-08-05 00h00 +00:00 A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
9.3
Critique
CVE-2024-37383 2024-06-06 22h00 +00:00 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
6.1
Moyen
CVE-2023-5631 2023-10-18 14h51 +00:00 Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
6.1
Moyen
CVE-2023-43770 2023-09-21 22h00 +00:00 Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
6.1
Moyen
CVE-2020-18671 2021-06-24 16h14 +00:00 Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
5.4
Moyen
CVE-2021-26925 2021-02-09 07h53 +00:00 Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
5.4
Moyen
CVE-2020-35730 2020-12-28 19h37 +00:00 An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
6.1
Moyen
CVE-2020-12625 2020-05-03 23h57 +00:00 An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
6.1
Moyen
CVE-2020-12626 2020-05-03 23h57 +00:00 An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
6.5
Moyen
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.