CVE-2018-9846

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "uid" parameter in an archive.php task=mail&mbox=INBOX&action=plugin.move2archive request to perform an MX IMAP injection attack by placing an IMAP...

CVE-2018-9846

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "uid" parameter in an archive.php task=mail&mbox=INBOX&action=plugin.move2archive request to perform an MX IMAP injection attack by placing an IMAP...

CVE-2018-9846

CVE-2018-9846 affects Roundcube versions 1.2.0–1.3.5 with the archive plugin enabled. The root cause is improper sanitization of the user-controlled _uid parameter in archive.php (request _task=mail&_mbox=INBOX&_action=plugin.move2archive), allowing an MX/IMAP command injection by appending comma...

CVE-2018-9846

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "uid" parameter in an archive.php task=mail&mbox=INBOX&action=plugin.move2archive request to perform an MX IMAP injection attack by placing an IMAP...

PT-2018-19070

Name of the Vulnerable Software and Affected Versions Roundcube versions 1.2.0 through 1.3.5 Description The issue allows for an IMAP injection attack by exploiting the unsanitized " uid" parameter in an archive.php request, specifically when the task=mail& mbox=INBOX& action=plugin.move2archive...

WordPress Plugin WP Publication Archive 2.0.1 - file Information Disclosure

WordPress Plugin WP Publication Archive 2.0.1 - file Information Disclosure source: https://www.securityfocus.com/bid/46000/info The WP Publication Archive Plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An...