PT-2017-8454

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.9 Roundcube Webmail versions 1.1.x prior to 1.1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted SVG. Recommendations For versio...

PT-2017-7495

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.9 Roundcube Webmail versions 1.1.x prior to 1.1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted SVG. Recommendations For versio...

Horde Groupware Cross-Site Scripting Vulnerability (CNVD-2016-02488)

Horde Groupware is email and communication solutions. A cross-site scripting vulnerability in Horde Groupware versions prior to 5.2.12 and Horde Groupware Webmail Edition versions prior to 5.2.12 allows remote attackers to inject arbitrary web script or HTML via numeric form fields...

DEBIAN-CVE-2015-8807

Cross-site scripting XSS vulnerability in the renderVarInputnumber function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2015-8807

Cross-site scripting XSS vulnerability in the renderVarInputnumber function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2016-2228: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in horde/templates/topbar/menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to...

CVE-2015-8807: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the renderVarInputnumber function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors...

Debian DSA-3541-1 : roundcube - security update

High-Tech Bridge Security Research Lab discovered that Roundcube, a webmail client, contained a path traversal vulnerability. This flaw could be exploited by an attacker to access sensitive files on the server, or even execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

[SECURITY] [DSA 3541-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3541-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 05, 2016 https://www.debian.org/security/faq -...

DSA-3541-1 roundcube - security update

Bulletin has no description...

webmail.artnews.com.au Open Redirect vulnerability

Vulnerable URL: https://webmail.artnews.com.au/horde/util/go.php?url=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 30.03.2016 Latest check for patch:| 30.03.2016 19:14 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

hands.com.tw XSS vulnerability

Vulnerable URL: http://hands.com.tw/webmail-cgi/XwebMail?task=login&action=...

webmail.math.tku.edu.tw XSS vulnerability

Vulnerable URL: http://webmail.math.tku.edu.tw/webmail-cgi/XwebMail?task=login&action=%3C/title%3E%3C/script/%27-alert%280%29-%27%22-%22--%3E%3Cimg/onerror=%22;alert%28/XSSPOSED/%29;%22src=1%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type...

webmail.telia.com XSS vulnerability

Vulnerable URL: https://webmail.telia.com/cp/ps/Mail/ExternalURLProxy?d=pne.telia.com=u50029537=javascript:alert%28%27XSSPOSED%27%29=-4.1716486624115645E-15 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicl...

webmail.talktalk.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-142248 Description| Value ---|--- Affected Website:| webmail.talktalk.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Roundcube: Multiple Vulnerabilities

Background Free and open source webmail software for the masses, written in PHP. Description Remote authenticated users with certain permissions can read arbitrary files or possibly execute arbitrary code via .. in the skin parameter to index.php. Additionally, a cross-site scripting XSS...

PT-2016-5074

Name of the Vulnerable Software and Affected Versions Horde Groupware versions prior to 5.2.12 Horde Groupware Webmail Edition versions prior to 5.2.12 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter. This c...

PT-2016-4032

Name of the Vulnerable Software and Affected Versions Horde Groupware versions prior to 5.2.12 Horde Groupware Webmail Edition versions prior to 5.2.12 Description A cross-site scripting XSS issue exists in the renderVarInput number function, allowing remote attackers to inject arbitrary web scri...

Roundcube Absolute Path Traversal Vulnerability

RoundCube Webmail is a browser-based IMAP client that supports address book management, message searching, spell checking and more. An absolute path traversal vulnerability exists in the program/steps/addressbook/photo.inc file in RoundCube Webmail, which allows remote attackers to read arbitrary...

Roundcube Cross-Site Scripting Vulnerability

RoundCube Webmail is a browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the program/include/rcmail.php script of RoundCube Webmail, which allows remote attackers to exploit the vulnerability...