Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Roundcube Subscribe
Filtered by product Webmail
Total 59 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-15237 2 Fedoraproject, Roundcube 2 Fedora, Webmail 2023-03-07 4.3 MEDIUM 7.4 HIGH
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
CVE-2020-13964 3 Debian, Fedoraproject, Roundcube 3 Debian Linux, Fedora, Webmail 2023-03-02 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
CVE-2020-16145 2 Fedoraproject, Roundcube 2 Fedora, Webmail 2023-01-20 4.3 MEDIUM 6.1 MEDIUM
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
CVE-2020-15562 2 Debian, Roundcube 2 Debian Linux, Webmail 2023-01-20 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
CVE-2017-8114 1 Roundcube 1 Webmail 2022-09-27 6.5 MEDIUM 8.8 HIGH
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
CVE-2020-12640 2 Opensuse, Roundcube 3 Backports Sle, Leap, Webmail 2022-09-02 7.5 HIGH 9.8 CRITICAL
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
CVE-2020-12625 3 Debian, Opensuse, Roundcube 4 Debian Linux, Backports Sle, Leap and 1 more 2022-09-02 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
CVE-2020-12626 2 Debian, Roundcube 2 Debian Linux, Webmail 2022-09-02 4.3 MEDIUM 6.5 MEDIUM
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
CVE-2019-10740 3 Fedoraproject, Opensuse, Roundcube 4 Fedora, Backports Sle, Leap and 1 more 2022-05-03 4.3 MEDIUM 4.3 MEDIUM
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
CVE-2020-12641 2 Opensuse, Roundcube 3 Backports Sle, Leap, Webmail 2022-04-29 7.5 HIGH 9.8 CRITICAL
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
CVE-2020-35730 3 Debian, Fedoraproject, Roundcube 3 Debian Linux, Fedora, Webmail 2022-04-23 4.3 MEDIUM 6.1 MEDIUM
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVE-2020-18671 1 Roundcube 1 Webmail 2022-03-10 3.5 LOW 5.4 MEDIUM
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
CVE-2021-26925 2 Fedoraproject, Roundcube 2 Fedora, Webmail 2022-03-10 3.5 LOW 5.4 MEDIUM
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
CVE-2020-18670 1 Roundcube 1 Webmail 2022-03-10 3.5 LOW 5.4 MEDIUM
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
CVE-2018-19206 2 Debian, Roundcube 2 Debian Linux, Webmail 2022-03-10 4.3 MEDIUM 6.1 MEDIUM
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
CVE-2018-19205 1 Roundcube 1 Webmail 2022-03-10 5.0 MEDIUM 7.5 HIGH
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
CVE-2021-44025 3 Debian, Fedoraproject, Roundcube 3 Debian Linux, Fedora, Webmail 2021-12-16 4.3 MEDIUM 6.1 MEDIUM
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
CVE-2021-44026 3 Debian, Fedoraproject, Roundcube 3 Debian Linux, Fedora, Webmail 2021-12-16 7.5 HIGH 9.8 CRITICAL
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVE-2017-16651 2 Debian, Roundcube 2 Debian Linux, Webmail 2021-03-04 4.6 MEDIUM 7.8 HIGH
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CVE-2020-13965 3 Debian, Fedoraproject, Roundcube 3 Debian Linux, Fedora, Webmail 2020-07-23 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.