DEBIAN-CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

UBUNTU-CVE-2015-5383

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

UBUNTU-CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

CVE-2015-5383

Summary: CVE-2015-5383 affects Roundcube Webmail 1.1.x before 1.1.2, where a remote attacker can read files from the config, temp, or logs directories to obtain sensitive information. The root cause is an information-disclosure path that allows unintended access to local files. The vulnerability ...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

CVE-2015-5382

The CVE-2015-5382 vulnerability affects Roundcube Webmail prior to 1.0.6 and 1.1.x prior to 1.1.2. Affected component: program/steps/addressbook/photo.inc. Root cause: information disclosure via the _alt parameter when uploading a vCard, allowing remote authenticated users to read arbitrary files...

CVE-2015-5381

Summary: The CVE-2015-5381 entry affects Roundcube Webmail 1.1.x before 1.1.2, where a cross-site scripting (XSS) vulnerability exists in the file program/include/rcmail.php . A remote attacker can exploit this by supplying a crafted payload to the _mbox parameter at the default URI, enabling inj...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

CVE-2015-5383

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

[SECURITY] [DLA 941-1] squirrelmail security update

Package : squirrelmail Version : 2:1.4.23svn20120406-2+deb7u1 CVE ID : CVE-2017-7692 Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, a webmail application, incorrectly handled a user-supplied value. This would allow a logged-in user to run arbitrary commands on the server. For...

[SECURITY] Fedora 24 Update: php-horde-ingo-3.2.15-1.fc24

Ingo is an email-filter management application. It is fully internationalized, integrated with Horde and the IMP Webmail client, and supports both server-side Sieve, Procmail, Maildrop and client-side IMAP message filtering...

Debian DSA-3852-1 : squirrelmail - security update

Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, a webmail application, incorrectly handled a user-supplied value. This would allow a logged-in user to run arbitrary commands on the server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Roundcube Webmail < 1.0.11, 1.1.x < 1.1.9, 1.2.x < 1.2.5 Password Reset Vulnerability

Roundcube Webmail is prone to an arbitrary password reset vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

[SECURITY] [DSA 3852-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3852-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 13, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3852-1] squirrelmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3852-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 13, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3852-1 (squirrelmail - security update)

Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, a webmail application, incorrectly handled a user-supplied value. This would allow a logged-in user to run arbitrary commands on the server. OpenVAS Vulnerability Test $Id: deb3852.nasl 6607 2017-07-07 12:04:25Z cfischer $...