Vulnerabilities > Roundcube

DATE CVE VULNERABILITY TITLE RISK
2020-12-28 CVE-2020-35730 Cross-Site Scripting vulnerability in Roundcube
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.
network
roundcube CWE-79
4.3
2020-08-12 CVE-2020-16145 Cross-Site Scripting vulnerability in Roundcube Webmail
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document.
network
roundcube CWE-79
4.3
2020-07-06 CVE-2020-15562 Cross-Site Scripting vulnerability in multiple products
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7.
4.3
2020-06-09 CVE-2020-13965 Cross-Site Scripting vulnerability in multiple products
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
4.3
2020-06-09 CVE-2020-13964 Cross-Site Scripting vulnerability in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
network
roundcube CWE-79
4.3
2020-05-04 CVE-2020-12641 Argument Injection OR Modification vulnerability in Roundcube Webmail
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
network
low complexity
roundcube CWE-88
7.5
2020-05-04 CVE-2020-12640 Path Traversal vulnerability in Roundcube Webmail
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
network
low complexity
roundcube CWE-22
7.5
2020-05-04 CVE-2020-12626 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
An issue was discovered in Roundcube Webmail before 1.4.4.
4.3
2020-05-04 CVE-2020-12625 Cross-Site Scripting vulnerability in multiple products
An issue was discovered in Roundcube Webmail before 1.4.4.
4.3
2019-08-20 CVE-2019-15237 Unspecified vulnerability in Roundcube Webmail
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
network
roundcube
4.3