Roundcube Webmail 1.5.x < 1.5.5 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.15 or 1.5.x prior to 1.5.5 or 1.6.x prior to 1.6.4. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via an HTML e-mail message with a crafted SVG document. Note that the scanner has not test...

Roundcube Webmail 1.6.x < 1.6.7 Multiples Vulnerabilities

According to its self-reported version number, Roundcube Webmail is prior to 1.5.7 or 1.6.x prior to 1.6.7. Therefore, it may be affected by multiple vulnerabilities : - A Cross-Site Scripting XSS via SVG animate attributes. - A Cross-Site Scripting XSS via list columns from user preferences. - A...

Roundcube Webmail 1.6.x < 1.6.3 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.14 or 1.5.x prior to 1.5.4 or 1.6.x prior to 1.6.3. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via text/plain e-mail messages with crafted links. Note that the scanner has not tested fo...

Roundcube Webmail 1.5.x < 1.5.8 Multiples Vulnerabilities

According to its self-reported version number, Roundcube Webmail is prior to 1.5.8 or 1.6.x prior to 1.6.8. Therefore, it may be affected by multiple vulnerabilities : - A Cross-Site Scripting XSS in rcmailactionmailget-run. - A Cross-Site Scripting XSS via a crafted e-mail message that abuses a...

Roundcube Webmail < 1.4.14 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.14 or 1.5.x prior to 1.5.4 or 1.6.x prior to 1.6.3. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via text/plain e-mail messages with crafted links. Note that the scanner has not tested fo...

Roundcube Webmail 1.5.x < 1.5.4 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.14 or 1.5.x prior to 1.5.4 or 1.6.x prior to 1.6.3. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via text/plain e-mail messages with crafted links. Note that the scanner has not tested fo...

Roundcube Webmail 1.6.x < 1.6.5 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.5.6 or 1.6.x prior to 1.6.5. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via a Content-Type or Content-Disposition header. Note that the scanner has not tested for these issues but has...

Roundcube Webmail 1.6.x < 1.6.8 Multiples Vulnerabilities

According to its self-reported version number, Roundcube Webmail is prior to 1.5.8 or 1.6.x prior to 1.6.8. Therefore, it may be affected by multiple vulnerabilities : - A Cross-Site Scripting XSS in rcmailactionmailget-run. - A Cross-Site Scripting XSS via a crafted e-mail message that abuses a...

Roundcube Webmail < 1.4.15 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.15 or 1.5.x prior to 1.5.5 or 1.6.x prior to 1.6.4. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via an HTML e-mail message with a crafted SVG document. Note that the scanner has not test...

Roundcube Webmail 1.5.x < 1.5.7 Multiples Vulnerabilities

According to its self-reported version number, Roundcube Webmail is prior to 1.5.7 or 1.6.x prior to 1.6.7. Therefore, it may be affected by multiple vulnerabilities : - A Cross-Site Scripting XSS via SVG animate attributes. - A Cross-Site Scripting XSS via list columns from user preferences. - A...

Roundcube Webmail 1.5.x < 1.5.6 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.5.6 or 1.6.x prior to 1.6.5. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via a Content-Type or Content-Disposition header. Note that the scanner has not tested for these issues but has...

Roundcube Webmail 1.6.x < 1.6.4 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.15 or 1.5.x prior to 1.5.5 or 1.6.x prior to 1.6.4. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via an HTML e-mail message with a crafted SVG document. Note that the scanner has not test...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

Zimbra Collaboration Suite 安全漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite ZCS versions 9.0, 10.0, and 10.1, which originates from a local file in an endpoint in the...

CVE-2024-54663: Inclusion of Functionality from Untrusted Control Sphere

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

NetWin SurgeMail 跨站脚本漏洞

NetWin SurgeMail is a full-featured SMTP / IMAP / POP / Webmail server from NetWin. A cross-site scripting vulnerability exists in NetWin SurgeMail version v78c2, which originates from a vulnerability that allows an attacker to execute arbitrary JavaScript code by injecting a carefully constructe...

CVE-2024-45194

In Zimbra Collaboration ZCS 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting XSS payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This...

CVE-2024-45517

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A Cross-Site Scripting XSS vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitizati...