4838 matches found
MGASA-2019-0420 Updated roundcubemail packages fix security vulnerability
The updated package fixes a security vulnerability: Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. CVE-2019-15237...
CVE-2019-19129
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name...
CVE-2019-19129
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name...
Cross site scripting
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name...
CVE-2019-19129
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name...
CVE-2019-19129
Technical details about CVE-2019-19129 are not publicly provided in the connected documents; no root cause, affected components, or fixes are disclosed. Monitor for updates.
CVE-2019-19129: Improper Neutralization of Input During Web Page Generation
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name...
CVE-2019-15072 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities...
CVE-2019-15073 Openfind MAIL2000 Webmail Pre-Auth Open Redirect
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities...
CVE-2019-15071 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of...
Google Gmail Cross-Site Scripting Vulnerability
Gmail is Google's free webmail service. Google Gmail suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject arbitrary web script or HTML...
Horde Groupware Webmail Cross-Site Request Forgery Vulnerability
Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A cross-site request forgery vulnerability exists in Horde Groupware Webmail version 5.1.2. The vulnerability stems from a WEB application that does not adequately validate that a request is coming...
PT-2020-3630 · Roundcube +4 · Roundcube Webmail +4
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.10 and earlier, 1.3.x before 1.3.14, and 1.4.x before 1.4.7 Description: The issue allows for cross-site scripting XSS via a crafted HTML e-mail message. This can be demonstrated by a JavaScript payload in the...
PT-2020-3640 · Roundcube +3 · Roundcube Webmail +3
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5 Description: The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impac...
PT-2023-5637
Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.4.14, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6.3. Description: Roundcube Webmail contains a cross-site scripting XSS vulnerability in the rcube string replacer.php component due to insufficient sanitization o...
PT-2025-23462
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.10 Roundcube Webmail versions 1.6.x prior to 1.6.11 Description Authenticated users can achieve remote code execution due to PHP Object Deserialization, a process where untrusted data is converted back...
PT-2020-3641 · Roundcube +3 · Roundcube Webmail +3
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.3.12 Roundcube Webmail versions 1.4.x prior to 1.4.5 Description: The issue is related to insufficient protection measures for web page structures in Roundcube Webmail, allowing a remote attacker to impac...
DEBIAN-CVE-2013-6275
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php...