Vulnerabilities > Roundcube > Webmail > 0.7.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-02-08 | CVE-2013-1904 | Path Traversal vulnerability in Roundcube Webmail Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013. | 5.0 |
| 2013-11-05 | CVE-2013-6172 | SQL Injection vulnerability in Roundcube Webmail steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code. | 7.5 |
| 2013-08-29 | CVE-2013-5645 | Cross-Site Scripting vulnerability in Roundcube Webmail Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. | 4.3 |
| 2013-02-24 | CVE-2012-6121 | Cross-Site Scripting vulnerability in Roundcube Webmail Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. | 4.3 |
| 2012-08-25 | CVE-2012-4668 | Cross-Site Scripting vulnerability in Roundcube Webmail Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email. | 4.3 |
| 2012-08-25 | CVE-2012-3507 | Cross-Site Scripting vulnerability in Roundcube Webmail Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject. | 2.6 |