176 matches found
DEBIAN-CVE-2026-114717
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...
CVE-2026-114716
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...
CVE-2026-114717
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...
EUVD-2026-107809
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...
CVE-2026-114717
Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability. The issue occurs when a message is forwarded as an attachment because the system uses the forwarded message's subject verbatim to generate the attachment name. An attacker can ...
CVE-2026-114717
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...
CVE-2026-114716
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...
EUVD-2026-107808
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...
CVE-2026-114716
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...
PT-2026-120949
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...
Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability
The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 within the 1.7.x series. This vulnerability arises because the flag parameter in the mail/mark action fails to filter CRLF sequences, potentially allowing remote authenticated...
ROS-20261021-73-0036
The vulnerability in rubygem-rack is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
SUSE CVE-2026-113386
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...
ROS-20261020-73-0100
The vulnerability in sg3Utils is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261019-73-0065
The vulnerability in Netty is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Aiohttp HTTP Client CRLF DoS
The vulnerability of the Aiohttp HTTP client is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability can allow a remote attacker to cause service failures...
ROS-20261005-73-0029
The vulnerability in rsync relates to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261001-73-0050
The vulnerability in rclone is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-102145: Improper Neutralization of CRLF Sequences
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and...