Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
430 results · page 4 of 9
Feb 6, 2020Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or CVE-2012-2593 · Other software · Atmail · reported by cret@cert.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
- Product
- Atmail Webmail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Jan 31, 2020In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.CVE-2020-8512 · Other software · Icewarp · reported by MITREMedium 6.1
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
- Product
- Icewarp Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.CVE-2019-19265 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgredteam-pentesting.de
Jan 5, 2020IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.CVE-2019-19266 · Other software · Icewarp · reported by MITREMedium 5.4
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgredteam-pentesting.de
Nov 26, 2019Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.CVE-2019-19129 · Other software · Afterlogic · reported by MITREMedium 6.1
Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
- Product
- Aurora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordafterlogic.comauroramail.wordpress.com
Nov 5, 2019Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.CVE-2013-6275 · Other software · Horde · reported by MITREMedium 6.5
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Nov 5, 2019Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address bookCVE-2013-6364 · Other software · Horde · reported by MITREHigh 8.8
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Oct 24, 2019Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to thCVE-2019-12095 · Other software · Horde · reported by MITREHigh 8.8
Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.horde.orgcxsecurity.com
Oct 24, 2019Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/conCVE-2019-12094 · Other software · Horde · reported by MITREMedium 6.1
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.horde.orgcxsecurity.com
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.CVE-2010-5340 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.CVE-2010-5339 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0CVE-2010-5338 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Oct 11, 2019IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10CVE-2010-5337 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuldb.comgosecurity.ch
Aug 19, 2019Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.CVE-2019-15237 · Websites & servers · Roundcube · reported by MITREHigh 7.4
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).CVE-2017-18473 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).CVE-2017-18437 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).CVE-2017-18433 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).CVE-2016-10816 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).CVE-2016-10815 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 1, 2019cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).CVE-2016-10859 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Jul 30, 2019cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).CVE-2019-14387 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netdocumentation.cpanel.net
Jul 19, 2019MDaemon Webmail (formerly WorldClient) has CSRF.CVE-2018-17792 · Other software · Altn · reported by MITREHigh 8.8
MDaemon Webmail (formerly WorldClient) has CSRF.
- Product
- Mdaemon Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 19, 2019An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail.CVE-2019-9763 · Other software · Openfind · reported by MITREMedium 6.1
An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an '<object data="data:text/html' substring in an e-mail message (The vendor subsequently patched this).
- Product
- Mail2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comopenfind.com.tw
Jun 3, 2019IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.CVE-2019-12593 · Other software · Icewarp · reported by MITREHigh 7.5
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 29, 2019Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.CVE-2019-9858 · Other software · Horde · reported by MITREHigh 8.8
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.debian.org
Apr 7, 2019In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.CVE-2019-10740 · Websites & servers · Roundcube · reported by MITREMedium 4.3
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Mar 12, 2019Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message.CVE-2019-9558 · Other software · Mailtraq · reported by MITREMedium 6.1
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 21, 2019MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).CVE-2019-8984 · Other software · Altn · reported by MITREMedium 6.1
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
- Product
- Mdaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2019MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).CVE-2019-8983 · Other software · Altn · reported by MITREMedium 6.1
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
- Product
- Mdaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2018steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML CVE-2018-19206 · Websites & servers · Roundcube · reported by MITREMedium 6.1
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Nov 12, 2018Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue CVE-2018-19205 · Websites & servers · Roundcube · reported by MITREHigh 7.5
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Sep 18, 2018Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the eCVE-2017-6913 · Other software · Open-xchange · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsoftware.open-xchange.com
Sep 1, 2018In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.CVE-2018-16324 · Other software · Icewarp · reported by MITREMedium 6.1
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
- Product
- Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstormsecurity.com
Apr 7, 2018In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" paraCVE-2018-9846 · Websites & servers · Roundcube · reported by MITREHigh 8.8
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2018iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protCVE-2018-1000072 · Other software · Iredmail · reported by MITREHigh 7.5
iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in Beta: 0.9.8-BETA1, Stable: 0.9.7.
- Product
- Iredmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlegacysecuritygroup.combitbucket.org
Mar 13, 2018roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key.CVE-2018-1000071 · Websites & servers · Roundcube · reported by MITREHigh 7.5
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlegacysecuritygroup.com
Feb 27, 2018Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project.CVE-2012-3536 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.
- Product
- Apache Hupa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsvn.apache.orgjames.apache.org
Nov 27, 2017The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of aCVE-2017-16962 · Other software · Communigate · reported by MITREMedium 6.1
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.
- Product
- Communigate Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 9, 2017Roundcube Webmail File Disclosure VulnerabilityCVE-2017-16651 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.8
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
- Product
- Roundcube Webmail
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsecurityfocus.com
Oct 23, 2017Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitraCVE-2015-5379 · Other software · Axigen · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment.
- Product
- Axigen Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Sep 19, 2017AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.CVE-2017-14597 · Other software · Afterlogic · reported by MITREMedium 4.8
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.
- Product
- Aurora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordauroramail.wordpress.comauroramail.wordpress.com
Aug 31, 2017In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.CVE-2017-7855 · Other software · Icewarp · reported by MITREMedium 6.1
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechnical.nttsecurity.comtechnical.nttsecurity.com
May 23, 2017Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directoryCVE-2015-5383 · Websites & servers · Roundcube · reported by MITREHigh 7.5
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- Product
- Roundcube Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
May 23, 2017program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _CVE-2015-5382 · Websites & servers · Roundcube · reported by MITREMedium 6.5
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
- Product
- Roundcube Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 23, 2017Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web sCVE-2015-5381 · Websites & servers · Roundcube · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
- Product
- Roundcube Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrac.roundcube.netopenwall.com
Apr 29, 2017Roundcube Webmail allows arbitrary password resets by authenticated users.CVE-2017-8114 · Websites & servers · Roundcube · reported by MITREHigh 8.8
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Apr 13, 2017Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTMLCVE-2016-4068 · Other software · Opensuse · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
- Product
- Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 13, 2017Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTMLCVE-2015-8864 · Other software · Opensuse · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
- Product
- Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 4, 2017In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled CVE-2017-7414 · Other software · Horde · reported by MITREHigh 7.5
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.horde.org
Apr 4, 2017In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated HordeCVE-2017-7413 · Other software · Horde · reported by MITREHigh 8.8
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.horde.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.