CVE-2020-18724

Authenticated stored cross-site scripting XSS in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list...

CVE-2020-18723

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

CVE-2020-18723

MDaemon Webmail 19.5.5 is affected by a Stored XSS in the file attachment field. The vulnerability allows an attacker to execute code on the email recipient’s side when forwarding an email. No remediation or patch details are provided in the connected documents. Exploitation status is not specifi...

MDaemon Webmail 跨站脚本漏洞

MDaemon Webmail is a server-side application for providing mail services from MDaemon, Inc. in the United States. A cross-site scripting vulnerability exists in MDaemon webmail 19.5.5, which allows attackers to execute code and XSS attacks while opening a contact list...

MDaemon Webmail 跨站脚本漏洞

MDaemon Webmail is a server-side application for providing mail services from MDaemon, Inc. in the United States. A cross-site scripting vulnerability exists in MDaemon webmail 19.5.5 that allows an attacker to execute code on the email recipient's end while forwarding an email...

PT-2021-10226

Name of the Vulnerable Software and Affected Versions: MDaemon webmail version 19.5.5 Description: The issue is related to an authenticated stored cross-site scripting XSS in the contact name field of the distribution list. This allows an attacker to execute code and perform a XSS attack when a...

PT-2021-10225

Name of the Vulnerable Software and Affected Versions: MDaemon webmail version 19.5.5 Description: The issue is related to stored cross-site scripting XSS in the file attachment field, allowing an attacker to execute code on the recipient's side when an email is forwarded, potentially leading to...

CVE-2020-18724: Improper Neutralization of Input During Web Page Generation

Authenticated stored cross-site scripting XSS in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list...

CVE-2020-18723: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities...

Roundcube Webmail 1.2 File Disclosure

Exploit Title: Roundcube Webmail 1.2 - File Disclosure Date: 09-11-2017 Exploit Author: stonepresto Vendor Homepage: https://roundcube.net/ Software Link: https://sourceforge.net/projects/roundcubemail/files/roundcubemail-beta/1.2-beta/ Version: 1.1.0 - 1.1.9, 1.2.0 - 1.2.6, 1.3.0 - 1.3.2 Tested...

Roundcube Webmail 1.2 - File Disclosure

Exploit Title: Roundcube Webmail 1.2 - File Disclosure Date: 09-11-2017 Exploit Author: stonepresto Vendor Homepage: https://roundcube.net/ Software Link: https://sourceforge.net/projects/roundcubemail/files/roundcubemail-beta/1.2-beta/ Version: 1.1.0 - 1.1.9, 1.2.0 - 1.2.6, 1.3.0 - 1.3.2 Tested...

[SECURITY] Fedora 33 Update: roundcubemail-1.4.10-1.fc33

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 32 Update: roundcubemail-1.4.10-1.fc32

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Roundcube Webmail < 1.2.13, 1.3.x < 1.3.16, 1.4.x < 1.4.10 XSS Vulnerability

Roundcube Webmail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora: Security Advisory for roundcubemail (FEDORA-2021-73359af51c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 33 : roundcubemail (2021-73359af51c)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-73359af51c advisory. - An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text...

Debian DSA-4821-1 : roundcube - security update

Alex Birnberg discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to a cross-site scripting vulnerability in handling HTML or Plain text messages with malicious content. C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2021-44696)

RoundCube Webmail is a browser-based, multi-language IMAP client with a desktop-like interface. A cross-site scripting vulnerability exists in linkrefaddindex in rcubestringreplacer.php in Roundcube Webmail, which can be exploited by an attacker via a specially crafted email...

CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...

CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...