70 matches found
CVE-2024-37383-exploit
Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...
CVE-2026-114717
A flaw was found in roundcubemail. When forwarding an email as an attachment, the application uses the original message's subject line directly to construct the attachment name without properly sanitizing line breaks. A remote attacker can exploit this vulnerability by sending an email containing...
Roundcube -- Multiple vulnerabilities
The Roundcube Mail project reports: IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action bug where an alias login wasn’t qualified by IMAP host Add a size limit to the CSS proxy content processing SSRF filter islocalurl bypass via NAT64 64:ff9b::/96 remote...
MGASA-2026-0507 Updated roundcubemail package fixes security vulnerabilities
Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai Fix CSS property injection via body background attribute, reported by zenithhostingevan Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo Fix email header...
Fedora 43 : roundcubemail (2026-914a40b4fd)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-914a40b4fd advisory. Release 1.6.18 - Password: Fix fatal error Class 'Zxcvbn' not found 10274 - Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF...
Fedora 44 : roundcubemail (2026-2aa96a9ce5)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2aa96a9ce5 advisory. Release 1.7.3 - OAuth: Don't log an error when a refreshed token's TTL is below refreshinterval 10213 - Fix out-of-bounds string reads on truncated...
PT-2026-80574
Updated roundcubemail to the 1.6.17 version to fix security vulnerabilities: Some XSS and DoS errors have been corrected. Various vulnerabilities in the password plugin have been fixed. An infinite loop has been fixed...
Fedora 43 : roundcubemail (2026-c3351f4ae4)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c3351f4ae4 advisory. Release 1.6.17 - Enigma: Support automatic public key lookup import using HKP v1 protocol 5314 - Enigma: Kolab WOAT Support 8626 - Security: Fix an...
Fedora 44 : roundcubemail (2026-517daa8d64)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-517daa8d64 advisory. Release 1.7.2 - Add HEAD request handler to the static.php - Fix so the oauthpasswordclaim claim is retrieved via token or userinfo request 9631 - F...
Security update for roundcubemail (important)
openSUSE Security Update: Security update for roundcubemail Announcement ID: openSUSE-SU-2026:0183-1 Rating: important References: 1266329 1266331 1266332 1266333 1266334 1266335 1266336 1266337 Cross-References: CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48845 CVE-2026-48846...
Security update for roundcubemail (important)
openSUSE security update: security update for roundcubemail ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20852-1 Rating: important References: bsc1266329 bsc1266331 bsc1266332 bsc1266333 bsc1266334 bsc1266335 bsc1266336 bsc1266337 Cross-Reference...
OPENSUSE-SU-2026:20852-1 Security update for roundcubemail
This update for roundcubemail fixes the following issues: Changes in roundcubemail: - update to 1.6.16 + Fix potential too long value in IMAP ID command 10136 + Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog CVE-2026-48849 bsc1266337 + Security: Fix CSS...
OPENSUSE-SU-2026:10869-1 roundcubemail-1.6.16-2.1 on GA media
These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed...
ROS-20260508-73-0007
Vulnerability in roundcubemail related to the use of an insecure alternate channel. Exploitation of the vulnerability could allow an attacker acting remotely to modify user projects and/or device configuration via cip commands...
ROS-20260508-73-0008
Vulnerability in roundcubemail related to the inclusion of features from an invalid controlled scope. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...
ROS-20260507-73-0003
Vulnerability in roundcubemail related to lack of validation of received requests. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...
ROS-20260507-73-0007
Vulnerability in roundcubemail related to argument injection or modification. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands...
ROS-20260507-73-0006
Vulnerability in roundcubemail related to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...