4838 matches found
UBUNTU-CVE-2020-12626
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...
Cross site request forgery (csrf)
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...
Cross site scripting
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting XSS vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message...
UBUNTU-CVE-2020-12625
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting XSS vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message...
CVE-2020-12625
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting XSS vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message...
CVE-2020-12625
CVE-2020-12625 concerns Roundcube Webmail up to version 1.4.3, with a cross-site scripting (XSS) vulnerability in rcube_washtml.php that allows JavaScript in HTML message CDATA to be executed. Public advisories (e.g., Ubuntu USN-5182-1, Debian DSA-4674-1, openSUSE openSUSE-2020-1516) confirm the ...
CVE-2020-12625
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting XSS vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message...
CVE-2020-12626
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...
CVE-2020-12626
Roundcube Webmail (Roundcube Webmail) CVE-2020-12626 is a CSRF vulnerability where an attacker can cause an authenticated user to be logged out by abusing POST requests. The issue arises from incorrect handling of login/logout POSTs and is documented across multiple connected sources, including D...
CVE-2020-12626
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...
CVE-2020-12641
rcubeimage.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for imconvertpath or imidentifypath. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
CVE-2020-12626: Cross-Site Request Forgery (CSRF)
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered...
CVE-2020-12625: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting XSS vulnerability in rcubewashtml.php because JavaScript code can occur in the CDATA of an HTML message...
CVE-2020-12640: Improper Limitation of a Pathname to a Restricted Directory
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcubepluginapi.php...
CVE-2020-12641: Improper Neutralization of Special Elements used in an OS Command
rcubeimage.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for imconvertpath or imidentifypath...
PT-2020-3643 · Roundcube +3 · Roundcube Webmail +3
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.4.4 Description: The issue is related to a CSRF attack that can cause an authenticated user to be logged out. This is because POST was not considered, leading to insufficient protection against cross-site...
PT-2020-3644 · Roundcube +4 · Roundcube Webmail +4
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.4.4 Description: The issue is related to a cross-site scripting XSS vulnerability in the rcube washtml.php file of Roundcube Webmail. This vulnerability occurs because JavaScript code can be present in th...
CVE-2020-7918
An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration...
Design/Logic Flaw
An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration...