VendorsRoundCubewebmail0.2.2
Vulnerabilities

RoundCube Webmail 0.2.2

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

8CVEs
CVE-2013-6172
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
Published 2013-11-05 · Modified
7.5EPSS 0.029
CVE-2013-1904
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
Published 2014-02-08 · Modified
5.0EPSS 0.023
CVE-2010-0464
Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Published 2010-01-29 · Modified
5.0EPSS 0.020
CVE-2012-4668
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
Published 2012-08-25 · Modified
4.31 PoCEPSS 0.037
CVE-2012-6121
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
Published 2013-02-24 · Modified
4.3EPSS 0.020
CVE-2013-5645
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
Published 2013-08-29 · Modified
4.3EPSS 0.019
CVE-2012-3507
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
Published 2012-08-25 · Modified
2.6EPSS 0.021
CVE-2012-1253
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
Published 2012-06-04 · Modified
2.6EPSS 0.018