Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting

Exploit Title: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting Date: 2018-09-09 Exploit Author: Fahimeh Rezaei Vendor Homepage: https://plugins.roundcube.net/packages/eagle00789/rcfilters Software Link: https://plugins.roundcube.net/packages/eagle00789/rcfilters Version: rcfilters plugin...

CVE-2018-16736

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the whatfilter and messages parameters in the Filters section of the settings...

Cross site scripting

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the whatfilter and messages parameters in the Filters section of the settings...

CVE-2018-16736

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the whatfilter and messages parameters in the Filters section of the settings...

CVE-2018-16736

CVE-2018-16736 affects the Roundcube rcfilters plugin (v2.1.6). The vulnerability is a Cross-Site Scripting (XSS) flaw exposed via the _whatfilter and _messages parameters in the Filters settings. Documented impact is cross-site scripting, with NVD listing CVSS v2 base score 3.5 (LOW) and CVSS v3...

CVE-2018-16736

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the whatfilter and messages parameters in the Filters section of the settings...

Roundcube Webmail < 1.3.7 Enigma Plugin PGP Vulnerability (EFAIL)

Roundcube Webmail is prone to an information disclosure vulnerability in the Enigma Plugin. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

MGASA-2018-0288 Updated roundcubemail packages fix security vulnerability

Updated roundcubemail package fixes security vulnerability: This update fixes a recently discovered IMAP command injection vulnerability caused by insufficient input validation within the archive plugin. CVE-2018-9846...

Information Disclosure

imscp/roundcube is vulnerable to information disclosures. The enigma plugin has insecure permissions, allowing a malicious user who has access to the web server to gain access to the gpg private key...

Roundcube Webmail archive.php IMAP Command Injection (CVE-2018-9846)

An IMAP command injection vulnerability exists in Roundcube Webmail. The vulnerability is due to improper handling of the "uid" parameter within certain HTTP requests. A remote attacker can exploit this vulnerability by enticing an authenticated user to visit a page which sends a request to the...

Roundcube Command Injection Vulnerability

RoundCube is a browser-based, multi-language IMAP client. A command injection vulnerability exists in RoundCube versions 1.2.0 through 1.3.5, which allows remote attackers to inject arbitrary IMAP commands and perform malicious actions due to a failure of the archive plugin to properly handle use...

Debian DSA-4181-1 : roundcube - security update

Andrea Basile discovered that the 'archive' plugin in roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize a user-controlled parameter, allowing a remote attacker to inject arbitrary IMAP commands and perform malicious actions. C Tenable Network Security...

[SECURITY] [DSA 4181-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4181-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 28, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4181-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4181-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 28, 2018 https://www.debian.org/security/faq -...

DSA-4181-1 roundcube - security update

Bulletin has no description...

[SECURITY] Fedora 28 Update: roundcubemail-1.3.6-1.fc28

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Debian: Security Advisory (DSA-4181-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: roundcubemail-1.3.6-1.fc27

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 26 Update: roundcubemail-1.3.6-1.fc26

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

FreeBSD : roundcube -- IMAP command injection vulnerability (48894ca9-3e6f-11e8-92f0-f0def167eeea)

Upstream reports : This update primarily fixes a recently discovered IMAP-cmd-injection vulnerability caused by insufficient input validation within the archive plugin. Details about the vulnerability are published under CVE-2018-9846. C Tenable Network Security, Inc. The descriptive text and...