Search
Find a vulnerability
Search criteria
18 vulnerabilities found for roundcube_webmail by roundcube
CVE-2024-37385 (GCVE-0-2024-37385)
Vulnerability from nvd – Published: 2024-06-07 03:24 – Updated: 2025-02-13 15:59
VLAI
EPSS
VEX
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-15 00:00 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | roundcube_webmail |
Affected:
0 , < 1.5.7
(custom)
cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:* |
|
| roundcube | roundcube_webmail |
Affected:
1.6.0 , < 1.6.7
(custom)
cpe:2.3:a:roundcube:roundcube_webmail:1.6.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:1.6.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.6.7",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-37385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T04:01:39.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-07T03:24:23.890Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-37385",
"datePublished": "2024-06-07T03:24:23.567Z",
"dateReserved": "2024-06-07T00:00:00.000Z",
"dateUpdated": "2025-02-13T15:59:49.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37384 (GCVE-0-2024-37384)
Vulnerability from nvd – Published: 2024-06-07 00:00 – Updated: 2024-11-04 16:24
VLAI
EPSS
VEX
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:48 UTC
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | roundcube_webmail |
Affected:
0 , < 1.5.7
(custom)
Affected: 1.6.x , < 1.6.7 (custom) cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.6.7",
"status": "affected",
"version": "1.6.x",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-37384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-17T17:48:19.770411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T16:24:03.779Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.175Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T15:06:04.942Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-37384",
"datePublished": "2024-06-07T00:00:00.000Z",
"dateReserved": "2024-06-07T00:00:00.000Z",
"dateUpdated": "2024-11-04T16:24:03.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5383 (GCVE-0-2015-5383)
Vulnerability from nvd – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4816 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.802Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5383",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4816",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5383",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5382 (GCVE-0-2015-5382)
Vulnerability from nvd – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4817 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2015/07/07/3 | mailing-listx_refsource_MLIST |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5382",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4817",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5382",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5381 (GCVE-0-2015-5381)
Vulnerability from nvd – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| http://trac.roundcube.net/ticket/1490417 | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4837 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "http://trac.roundcube.net/ticket/1490417",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4837",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5381",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-4068 (GCVE-0-2016-4068)
Vulnerability from nvd – Published: 2017-04-13 14:00 – Updated: 2024-08-06 00:17
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/wiki/C… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
Date Public
2016-01-06 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:17:30.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-4068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-4068",
"datePublished": "2017-04-13T14:00:00.000Z",
"dateReserved": "2016-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:17:30.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8864 (GCVE-0-2015-8864)
Vulnerability from nvd – Published: 2017-04-13 14:00 – Updated: 2024-08-06 08:29
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/wiki/C… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
Date Public
2015-12-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:22.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-8864",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-8864",
"datePublished": "2017-04-13T14:00:00.000Z",
"dateReserved": "2016-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:29:22.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8794 (GCVE-0-2015-8794)
Vulnerability from nvd – Published: 2016-01-29 19:00 – Updated: 2024-09-16 22:20
VLAI
EPSS
VEX
Summary
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| http://trac.roundcube.net/ticket/1490379 | x_refsource_CONFIRM |
| http://trac.roundcube.net/changeset/e84fafcec/github | x_refsource_CONFIRM |
| http://trac.roundcube.net/changeset/6ccd4c54b/github | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:21.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-01-29T19:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"name": "http://trac.roundcube.net/ticket/1490379",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"name": "http://trac.roundcube.net/changeset/e84fafcec/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"name": "http://trac.roundcube.net/changeset/6ccd4c54b/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8794",
"datePublished": "2016-01-29T19:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:20:24.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8770 (GCVE-0-2015-8770)
Vulnerability from nvd – Published: 2016-01-29 19:00 – Updated: 2024-08-06 08:29
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201603-03 | vendor-advisoryx_refsource_GENTOO |
| http://www.debian.org/security/2016/dsa-3541 | vendor-advisoryx_refsource_DEBIAN |
| http://trac.roundcube.net/changeset/10e5192a2b/github | x_refsource_CONFIRM |
| http://www.securityfocus.com/archive/1/537304/100… | mailing-listx_refsource_BUGTRAQ |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://roundcube.net/news/2015/12/26/updates-1.1… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://trac.roundcube.net/ticket/1490620 | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135274/Round… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39245/ | exploitx_refsource_EXPLOIT-DB |
| https://www.htbridge.com/advisory/HTB23283 | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Date Public
2015-12-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:21.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8770",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201603-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"name": "http://trac.roundcube.net/changeset/10e5192a2b/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"name": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"name": "http://trac.roundcube.net/ticket/1490620",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"name": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"name": "https://www.htbridge.com/advisory/HTB23283",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8770",
"datePublished": "2016-01-29T19:00:00.000Z",
"dateReserved": "2016-01-13T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:29:21.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37385 (GCVE-0-2024-37385)
Vulnerability from cvelistv5 – Published: 2024-06-07 03:24 – Updated: 2025-02-13 15:59
VLAI
EPSS
VEX
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-15 00:00 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | roundcube_webmail |
Affected:
0 , < 1.5.7
(custom)
cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:* |
|
| roundcube | roundcube_webmail |
Affected:
1.6.0 , < 1.6.7
(custom)
cpe:2.3:a:roundcube:roundcube_webmail:1.6.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:1.6.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.6.7",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-37385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T04:01:39.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-07T03:24:23.890Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-37385",
"datePublished": "2024-06-07T03:24:23.567Z",
"dateReserved": "2024-06-07T00:00:00.000Z",
"dateUpdated": "2025-02-13T15:59:49.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37384 (GCVE-0-2024-37384)
Vulnerability from cvelistv5 – Published: 2024-06-07 00:00 – Updated: 2024-11-04 16:24
VLAI
EPSS
VEX
Summary
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:48 UTC
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| roundcube | roundcube_webmail |
Affected:
0 , < 1.5.7
(custom)
Affected: 1.6.x , < 1.6.7 (custom) cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "roundcube_webmail",
"vendor": "roundcube",
"versions": [
{
"lessThan": "1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.6.7",
"status": "affected",
"version": "1.6.x",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-37384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-17T17:48:19.770411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-04T16:24:03.779Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.175Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T15:06:04.942Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.7"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7"
},
{
"name": "[debian-lts-announce] 20240617 [SECURITY] [DLA 3835-1] roundcube security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-37384",
"datePublished": "2024-06-07T00:00:00.000Z",
"dateReserved": "2024-06-07T00:00:00.000Z",
"dateUpdated": "2024-11-04T16:24:03.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5382 (GCVE-0-2015-5382)
Vulnerability from cvelistv5 – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4817 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2015/07/07/3 | mailing-listx_refsource_MLIST |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5382",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4817",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4817"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "[oss-security] 20150707 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5382",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5381 (GCVE-0-2015-5381)
Vulnerability from cvelistv5 – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| http://trac.roundcube.net/ticket/1490417 | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4837 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "http://trac.roundcube.net/ticket/1490417",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490417"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4837",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4837"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/b782815dacda55eee6793249b5da1789256206fc"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5381",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-5383 (GCVE-0-2015-5383)
Vulnerability from cvelistv5 – Published: 2017-05-23 03:56 – Updated: 2024-08-06 06:50
VLAI
EPSS
VEX
Summary
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/07/07/2 | mailing-listx_refsource_MLIST |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4816 | x_refsource_CONFIRM |
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
Date Public
2015-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:50:00.802Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-23T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-5383",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20150706 Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2015/07/07/2"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/012555c1cef35601b543cde67bff8726de97eb39"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4816",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4816"
},
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-5383",
"datePublished": "2017-05-23T03:56:00.000Z",
"dateReserved": "2015-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T06:50:00.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-4068 (GCVE-0-2016-4068)
Vulnerability from cvelistv5 – Published: 2017-04-13 14:00 – Updated: 2024-08-06 00:17
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/wiki/C… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
Date Public
2016-01-06 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:17:30.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-4068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-4068",
"datePublished": "2017-04-13T14:00:00.000Z",
"dateReserved": "2016-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:17:30.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8864 (GCVE-0-2015-8864)
Vulnerability from cvelistv5 – Published: 2017-04-13 14:00 – Updated: 2024-08-06 08:29
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/roundcube/roundcubemail/commit… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/wiki/C… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
| https://github.com/roundcube/roundcubemail/issues/4949 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2016-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/roundcube/roundcubemail/releas… | x_refsource_CONFIRM |
Date Public
2015-12-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:22.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-13T12:57:01.000Z",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-8864",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"name": "openSUSE-SU-2016:2108",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115"
},
{
"name": "openSUSE-SU-2016:2109",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.0.9"
},
{
"name": "https://github.com/roundcube/roundcubemail/issues/4949",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/issues/4949"
},
{
"name": "openSUSE-SU-2016:2127",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html"
},
{
"name": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"refsource": "CONFIRM",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-8864",
"datePublished": "2017-04-13T14:00:00.000Z",
"dateReserved": "2016-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:29:22.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8770 (GCVE-0-2015-8770)
Vulnerability from cvelistv5 – Published: 2016-01-29 19:00 – Updated: 2024-08-06 08:29
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201603-03 | vendor-advisoryx_refsource_GENTOO |
| http://www.debian.org/security/2016/dsa-3541 | vendor-advisoryx_refsource_DEBIAN |
| http://trac.roundcube.net/changeset/10e5192a2b/github | x_refsource_CONFIRM |
| http://www.securityfocus.com/archive/1/537304/100… | mailing-listx_refsource_BUGTRAQ |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://roundcube.net/news/2015/12/26/updates-1.1… | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://trac.roundcube.net/ticket/1490620 | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135274/Round… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39245/ | exploitx_refsource_EXPLOIT-DB |
| https://www.htbridge.com/advisory/HTB23283 | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Date Public
2015-12-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:21.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201603-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8770",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201603-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201603-03"
},
{
"name": "DSA-3541",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3541"
},
{
"name": "http://trac.roundcube.net/changeset/10e5192a2b/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/10e5192a2b/github"
},
{
"name": "20160113 Remote Code Execution in Roundcube",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/537304/100/0/threaded"
},
{
"name": "openSUSE-SU-2016:0214",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00030.html"
},
{
"name": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/12/26/updates-1.1.4-and-1.0.8-released/"
},
{
"name": "openSUSE-SU-2016:0210",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00028.html"
},
{
"name": "http://trac.roundcube.net/ticket/1490620",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490620"
},
{
"name": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135274/Roundcube-1.1.3-Path-Traversal.html"
},
{
"name": "39245",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39245/"
},
{
"name": "https://www.htbridge.com/advisory/HTB23283",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23283"
},
{
"name": "openSUSE-SU-2016:0213",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00029.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8770",
"datePublished": "2016-01-29T19:00:00.000Z",
"dateReserved": "2016-01-13T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:29:21.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-8794 (GCVE-0-2015-8794)
Vulnerability from cvelistv5 – Published: 2016-01-29 19:00 – Updated: 2024-09-16 22:20
VLAI
EPSS
VEX
Summary
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://roundcube.net/news/2015/06/05/updates-1.1… | x_refsource_CONFIRM |
| http://trac.roundcube.net/ticket/1490379 | x_refsource_CONFIRM |
| http://trac.roundcube.net/changeset/e84fafcec/github | x_refsource_CONFIRM |
| http://trac.roundcube.net/changeset/6ccd4c54b/github | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:21.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-01-29T19:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/",
"refsource": "CONFIRM",
"url": "https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/"
},
{
"name": "http://trac.roundcube.net/ticket/1490379",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/ticket/1490379"
},
{
"name": "http://trac.roundcube.net/changeset/e84fafcec/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/e84fafcec/github"
},
{
"name": "http://trac.roundcube.net/changeset/6ccd4c54b/github",
"refsource": "CONFIRM",
"url": "http://trac.roundcube.net/changeset/6ccd4c54b/github"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8794",
"datePublished": "2016-01-29T19:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:20:24.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}