CVE-2016-4069

Roundcube Webmail is affected by CVE-2016-4069 (CSRF) in versions before 1.1.5. The vulnerability allows remote attackers to hijack user authentication for requests that download attachments, leading to a denial of service (disk consumption) via unspecified vectors. The available documents do not...

CVE-2016-4069

Cross-site request forgery CSRF vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service disk consumption via unspecified vectors...

Debian DLA-537-1 : roundcube security update

Roundcube, a webmail solution for IMAP servers, was susceptible to cross-site-scripting XSS vulnerabilities when handling SVG images. When right-clicking on the download link of an attached image, it was possible that embedded JavaScript could be executed in a separate Tab. The update disables...

[SECURITY] [DLA 537-1] roundcube security update

Package : roundcube Version : 0.7.2-9+deb7u3 CVE ID : CVE-2015-8864 Roundcube, a webmail solution for IMAP servers, was susceptible to cross-site-scripting XSS vulnerabilities when handling SVG images. When right-clicking on the download link of an attached image, it was possible that embedded...

DLA-537-1 roundcube - security update

Bulletin has no description...

[SECURITY] Fedora 24 Update: roundcubemail-1.2.0-1.fc24

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

FreeBSD : roundcube -- XSS vulnerability (97e86d10-2ea7-11e6-ae88-002590263bf5)

Roundcube reports : Fix XSS issue in href attribute on area tag 5240. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution an...

[SECURITY] Fedora 22 Update: roundcubemail-1.2.0-1.fc22

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-03672)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the email content page of RoundCube Webmail. An attacker can exploit this vulnerability to inject arbitrar...

[SECURITY] Fedora 24 Update: roundcubemail-1.1.5-1.fc24

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

roundcube -- XSS vulnerability

Roundcube reports: Fix XSS issue in href attribute on area tag 5240...

Fedora 22 : roundcubemail-1.1.5-1.fc22 (2016-a9c8f9dcff)

Release 1.1.5 Plugin API: Added html2text hook Plugin API: Added addressbookexport hook Fix missing emoticons on html-to-text conversion Fix random 'access to this resource is secured against CSRF' message at logout 4956 Fix missing language name in 'Add to Dictionary' request in HTML mode 4951...

[SECURITY] Fedora 22 Update: roundcubemail-1.1.5-1.fc22

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 23 Update: roundcubemail-1.1.5-1.fc23

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-02712)

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site scripting vulnerability exists in RoundCube Webmail, which can be exploited by an attacker to inject arbitrary web script or HTML...

RoundCube Webmail Cross-Site Request Forgery Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site request forgery vulnerability exists in RoundCube Webmail, which can be exploited by an attacker to download message attachments by sending a GET request with the download parameter set to 1...

RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-02711)

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site scripting vulnerability exists in RoundCube Webmail, which can be exploited to inject arbitrary web script or HTML with the help of specially crafted Svg image files...

PT-2017-8454

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.9 Roundcube Webmail versions 1.1.x prior to 1.1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted SVG. Recommendations For versio...

PT-2016-5836

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.1.5 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that download attachments, potentially causing a denial of service due to disk...

Debian DSA-3541-1 : roundcube - security update

High-Tech Bridge Security Research Lab discovered that Roundcube, a webmail client, contained a path traversal vulnerability. This flaw could be exploited by an attacker to access sensitive files on the server, or even execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...