Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

430 results · page 3 of 9

Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38190 · Other software · Superwebmailer · reported by MITREHigh 8.8
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.
Product
Superwebmailer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record herolab.usd.de herolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38191 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.
Product
Superwebmailer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record herolab.usd.de herolab.usd.de
Oct 18, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-5631 · Websites & servers · Roundcube · reported by security@eset.comExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
Product
Webmail
On CISA’s list since
Oct 26, 2023 (federal fix deadline Nov 16, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Oct 10, 2023An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an autheCVE-2023-36556 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.
Product
FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Sep 22, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-43770 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
Product
Webmail
On CISA’s list since
Feb 12, 2024 (federal fix deadline Mar 4, 2024)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com lists.debian.org
Sep 12, 2023Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.CVE-2023-41013 · Other software · Icewarp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
Product
Icewarp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Sep 6, 2022An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attaCVE-2022-26114 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.4
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.
Product
Fortinet FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Aug 23, 2022IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.CVE-2022-35115 · Other software · Icewarp · reported by MITRECritical 9.8
IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.
Product
Webclient Dc2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.icewarp.com veysel-xan.com
Aug 12, 2022An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.CVE-2022-37043 · Email & office · Zimbra · reported by MITREMedium 5.7
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
Product
Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jul 28, 2022Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.CVE-2022-30287 · Other software · Horde · reported by MITREHigh 8
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
Product
Groupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com lists.debian.org
Jul 28, 2022The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.CVE-2022-29360 · Other software · Rainloop · reported by MITREMedium 5.4
The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com lists.debian.org
Jun 7, 2022An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attaCVE-2022-31470 · Other software · Axigen · reported by MITREMedium 6.1
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.
Product
Axigen Mobile Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com axigen.com
Apr 26, 2022An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4.CVE-2022-28218 · Other software · Ciphermail · reported by MITREMedium 5.5
An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys (found in a Roundcube configuration file) that are used to protect Webmail user passwords and two-factor authentication (2FA).
Product
Webmail Messenger
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ciphermail.com lists.ciphermail.com
Mar 11, 2022lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail EdCVE-2022-26874 · Other software · Horde · reported by MITREMedium 5.4
lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
Product
Horde Mime Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sonarsource.com github.com
Nov 18, 2021Roundcube Webmail SQL Injection VulnerabilityCVE-2021-44026 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.debian.org github.com
Nov 18, 2021Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.CVE-2021-44025 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org github.com
Jul 12, 2021Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via spCVE-2021-24013 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.
Product
Fortinet FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 12, 2021A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauCVE-2021-26090 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.3
A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.
Product
Fortinet FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 9, 2021Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attaCVE-2021-22129 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
Product
Fortinet FortiMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 7, 2021Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.CVE-2020-25925 · Other software · Icewarp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
Product
Webclient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ashketchum.medium.com ashketchum.medium.com
Jun 24, 2021Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.CVE-2020-18671 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lorexxar.cn
Jun 24, 2021Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.CVE-2020-18670 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lorexxar.cn
Mar 6, 2021An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9.CVE-2021-26294 · Other software · Afterlogic · reported by MITREHigh 7.5
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
Product
Aurora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 4, 2021An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled.CVE-2021-26293 · Other software · Afterlogic · reported by MITRECritical 9.8
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
Product
Aurora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record auroramail.wordpress.com auroramail.wordpress.com
Feb 13, 2021An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used).CVE-2021-26929 · Other software · Horde · reported by MITREMedium 6.1
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.
Product
Groupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 9, 2021Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.CVE-2021-26925 · Websites & servers · Roundcube · reported by MITREMedium 5.4
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.fedoraproject.org
Feb 3, 2021Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes codeCVE-2020-18724 · Other software · Altn · reported by MITREMedium 5.4
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
Product
Mdaemon Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kailashbohara.com.np packetstormsecurity.com
Feb 3, 2021Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarCVE-2020-18723 · Other software · Altn · reported by MITREMedium 5.4
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
Product
Mdaemon Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kailashbohara.com.np packetstormsecurity.com
Dec 28, 2020Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-35730 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.debian.org github.com
Aug 12, 2020Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document.CVE-2020-16145 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org github.com
Jul 14, 2020SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php.CVE-2020-11546 · Other software · Superwebmailer · reported by MITRECritical 9.8
SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.
Product
Superwebmailer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.to.com blog.to.com
Jul 6, 2020An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7.CVE-2020-15562 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org github.com
Jul 2, 2020An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11.CVE-2020-13653 · Email & office · Synacor · reported by MITREMedium 6.1
An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.
Product
Zimbra Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wiki.zimbra.com wiki.zimbra.com
Jun 10, 2020An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 throughCVE-2020-12713 · Other software · Ciphermail · reported by MITREHigh 7.2
An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multiple options to escalate their privileges to the Unix root account.
Product
Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com ciphermail.com
Jun 8, 2020Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-13965 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
Product
Webmail
On CISA’s list since
Jun 26, 2024 (federal fix deadline Jul 17, 2024)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 8, 2020An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.CVE-2020-13964 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 18, 2020Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability CVE-2020-8034 · Other software · Horde · reported by MITREMedium 6.1
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
Product
Gollem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 18, 2020The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image CVE-2020-8035 · Other software · Horde · reported by MITREMedium 6.1
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
Product
Groupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
May 4, 2020Roundcube Webmail Remote Code Execution VulnerabilityCVE-2020-12641 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org github.com
May 4, 2020Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.CVE-2020-12640 · Websites & servers · Roundcube · reported by MITRECritical 9.8
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org github.com
May 3, 2020An issue was discovered in Roundcube Webmail before 1.4.4.CVE-2020-12626 · Websites & servers · Roundcube · reported by MITREMedium 6.5
An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 3, 2020An issue was discovered in Roundcube Webmail before 1.4.4.CVE-2020-12625 · Websites & servers · Roundcube · reported by MITREMedium 6.1
An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org github.com
Mar 27, 2020An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other userCVE-2020-7918 · Other software · Totemo · reported by MITREMedium 5.4
An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.
Product
Totemomail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record objectif-securite.ch totemo.com
Mar 23, 2020This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22.CVE-2020-8866 · Other software · Horde · reported by zdi-disclosures@trendmicro.comMedium 6.5
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.
Product
Groupware Webmail Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.horde.org
Mar 23, 2020This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22.CVE-2020-8865 · Other software · Horde · reported by zdi-disclosures@trendmicro.comMedium 6.3
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10469.
Product
Groupware Webmail Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org zerodayinitiative.com
Mar 20, 2020RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy headeCVE-2019-13389 · Other software · Rainloop · reported by MITREMedium 6.1
RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Mar 17, 2020cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).CVE-2020-10122 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).CVE-2019-20490 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Feb 17, 2020Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.CVE-2020-8518 · Other software · Horde · reported by MITRECritical 9.8
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
Product
Groupware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com lists.debian.org
Feb 8, 2020The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users'CVE-2012-5570 · Other software · Basic Webmail Project · reported by Red HatMedium 4.3
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
Product
Basic Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.