CVE-2015-8105

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

CVE-2015-8105

CVE-2015-8105 affects Roundcube webmail, specifically the vulnerable component is program/js/app.js. The XSS flaw arises in the drag-and-drop file upload via the filename field, impacting Roundcube versions before 1.0.7 and 1.1.x before 1.1.3. Exploitation requires remote authenticated access, en...

PT-2015-2647

Name of the Vulnerable Software and Affected Versions RoundCube Webmail versions prior to 1.0.7 RoundCube Webmail versions 1.1.x prior to 1.1.3 Description The issue exists due to a lack of protection for the web page structure in the RoundCube Webmail component program/js/app.js. This allows a...

tierramor.org XSS vulnerability

Vulnerable URL: http://www.tierramor.org/webmail/index.php?femail=sample%40email.tst%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Ealert%28/XSSPOSED/%29%3C/ScRiPt%3Euser==bg==clean Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 21:44 GMT...

[SECURITY] Fedora 21 Update: php-horde-ingo-3.2.7-1.fc21

Ingo is an email-filter management application. It is fully internationalized, integrated with Horde and the IMP Webmail client, and supports both server-side Sieve, Procmail, Maildrop and client-side IMAP message filtering...

[SECURITY] Fedora 21 Update: php-horde-imp-6.2.11-1.fc21

IMP, the Internet Mail Program, is one of the most popular and widely deployed open source webmail applications in the world. It allows universal, web-based access to IMAP and POP3 mail servers and provides Ajax, mobile and traditional interfaces with a rich range of features normally found only ...

[SECURITY] Fedora 22 Update: php-horde-ingo-3.2.7-1.fc22

Ingo is an email-filter management application. It is fully internationalized, integrated with Horde and the IMP Webmail client, and supports both server-side Sieve, Procmail, Maildrop and client-side IMAP message filtering...

PT-2015-7692

Name of the Vulnerable Software and Affected Versions Horde versions prior to 5.2.8 Horde Groupware versions prior to 5.2.11 Horde Groupware Webmail Edition versions prior to 5.2.11 Description Multiple cross-site request forgery CSRF issues allow remote attackers to hijack the authentication of...

[SECURITY] Fedora 23 Update: php-horde-imp-6.2.11-1.fc23

IMP, the Internet Mail Program, is one of the most popular and widely deployed open source webmail applications in the world. It allows universal, web-based access to IMAP and POP3 mail servers and provides Ajax, mobile and traditional interfaces with a rich range of features normally found only ...

PT-2017-6849

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.0.6 Roundcube Webmail versions 1.1.x prior to 1.1.2 Description The issue allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard. This is related to the...

Coremail一处存储型跨站脚本（有触发条件）

简要描述： Coremail一处存储型跨站脚本漏洞，已申请CVE编号：CVE-2015-6942 详细说明： 影响版本：XT3.0 其他版本未测试 测试步骤： 1.首先创建一个带有超链接的doc文档，超链接为"javascript:alert" 2.创建一封邮件并上传附件，然后发送给需要攻击的用户可发送给任意用户。 3.受害者如果在WebMail里打开邮件并在线预览doc文档时，点击超链接，即可执行攻击代码。 4.重新将文档中的超链接换成location.href方式获取Cookie的超连接的即可...

Roundcube Webmail Detection (HTTP)

HTTP based detection of Roundcube Webmail. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH SPDX-FileCopyrightText: Improved code and additional detection routines since 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

search.webmail.co.za XSS vulnerability

Open Bug Bounty ID: OBB-79986 Description| Value ---|--- Affected Website:| search.webmail.co.za Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

ns1.arkebit.com XSS vulnerability

Vulnerable URL: http://ns1.arkebit.com/webmail/index.php?femail=sample%40email.tst'%22%26%25prompt/XSSPOSED/...

[SECURITY] Fedora 21 Update: roundcubemail-1.1.2-1.fc21

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

CVE-2015-5379: Axigen XSS vulnerability for html attachments

CVEID: CVE-2015-5379 SUBJECT: Axigen XSS vulnerability for html attachments DESCRIPTION: Axigen's WebMail Ajax interface implements a view attachment function that executes javascript code that is part of email HTML attachments. This allows a malicious user to craft email messages that could expo...

SquirrelMail 1.4.5-RC1 - Arbitrary Variable Overwrite

SquirrelMail 1.4.5-RC1 - Arbitrary Variable Overwrite SquirrelMail Arbitrary Variable Overwrite Vendor: The SquirrelMail Project Team Product: SquirrelMail Version: = 1.4.5-RC1 Website: http://www.squirrelmail.org/ BID: 14254 CVE: CVE-2005-2095 SECUNIA: 16058 PACKETSTORM: 38709 Description:...

SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite

SquirrelMail Arbitrary Variable Overwrite Vendor: The SquirrelMail Project Team Product: SquirrelMail Version: = 1.4.5-RC1 Website: http://www.squirrelmail.org/ BID: 14254 CVE: CVE-2005-2095 SECUNIA: 16058 PACKETSTORM: 38709 Description: SquirrelMail is a standards-based webmail package written i...

Roundcube Webmail Arbitrary File Read Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. An arbitrary file read vulnerability exists in Roundcube Webmail. An attacker can exploit this vulnerability to read arbitrary files...

Roundcube Webmail Cross-Site Scripting Vulnerability

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in Roundcube Webmail. An attacker can exploit this vulnerability to execute arbitrary script code in a browse...