Fedora 26 : roundcubemail (2017-7263e7d321)

Roundcube Webmail 1.2.5 This is a security update to the stable version 1.2. It primarily fixes a recently discovered vulnerability in the virtualmin and sasl drivers of the password plugin plus adds a few cherry-picked bug fixes from upstream versions. A detailed list of changes is shown below...

Vodafone Italia Webmail Cross Site Scripting

Title: Vodafone Webmail - Stored Cross-Site Scripting Date: 2017-07-14 Exploit Author: theMiddle / https://github.com/theMiddleBlue Website: https://web.mail.vodafone.it 1. Description the Vodafone Italia webmail web.mail.vodafone.it suffers from a stored cross-site scripting vulnerability. The...

RoundCube: Security bypass

Background Free and open source webmail software for the masses, written in PHP. Description Authenticated users can arbitrarily reset passwords due to a problem caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Impact Authenticated users can...

webmail.bait.net.pl Open Redirect vulnerability

Vulnerable URL: http://webmail.bait.net.pl/horde/util/go.php?url=https://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 21.09.2017 Latest check for patch:| 21.09.2017 13:57 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknow...

AtMail Cross-Site Request Forgery Vulnerability (CNVD-2017-09349)

AtMail is an open source WebMail client from the Australian company Atmail , which provides a Webmail interface , address book management , calendars and other features , and supports IMAP, video mail and so on. A cross-site request forgery vulnerability exists in Atmail versions prior to 7.8.0.2...

[SECURITY] Fedora 26 Update: squirrelmail-1.4.22-19.fc26

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

hosting24.com XSS vulnerability

Vulnerable URL: https://www.hosting24.com/webmaillogin.php?action=login Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 85113 VIP website status:| Yes Coordinated Disclosure Timelin...

[SECURITY] Fedora 25 Update: squirrelmail-1.4.22-19.fc25

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

[SECURITY] Fedora 24 Update: squirrelmail-1.4.22-19.fc24

SquirrelMail is a basic webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 with no JavaScript for maximum compatibility across browsers. It has very few requirements and is very easy to configure and instal...

Roundcube Webmail < 1.0.6, 1.1.x < 1.1.2 Multiple Vulnerabilities

Roundcube Webmail is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

acesso.uol.com.br XSS vulnerability

Vulnerable URL: https://acesso.uol.com.br/login.html?skin=webmail Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5649 VIP website status:| Yes Coordinated Disclosure Timeline:...

Roundcube Webmail Information Disclosure Vulnerability (CNVD-2017-08084)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. An information disclosure vulnerability exists in Roundcube Webmail version 1.1.x before 1.1.2. A remote attacker can exploit this vulnerability by readi...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2017-08082)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the program/include/rcmail.php file in version 1.1.x prior to Roundcube Webmail 1.1.2. A remote attacker c...

Roundcube Webmail Information Disclosure Vulnerability (CNVD-2017-08083)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. An information disclosure vulnerability exists in the program/steps/addressbook/photo.inc file in Roundcube Webmail versions prior to 1.0.6 and 1.1.x...

CVE-2015-5383

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

DEBIAN-CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

Code injection

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...