Heist/ feed

Security feed

advisoryCISA Known Exploited Vulnerabilities

Roundcube Webmail File Disclosure Vulnerability

Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. CISA required action: Apply updates per vendor instructions.

Roundcube WebmailCVE-2017-16651
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-16651

Roundcube Webmail

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2017-16651

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#3698 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Roundcube Webmail SQL Injection Vulnerability

Roundcube Webmail is vulnerable to SQL injection via search or search_params. CISA required action: Apply updates per vendor instructions.

Roundcube WebmailCVE-2021-44026
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-44026

Roundcube Webmail

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2021-44026

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#1309 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Roundcube Webmail Remote Code Execution Vulnerability

Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. CISA required action: Apply updates per vendor instructions.

Roundcube WebmailCVE-2020-12641
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-12641

Roundcube Webmail

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2020-12641

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#1308 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryCISA Known Exploited Vulnerabilities

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. CISA required action: Apply updates per vendor instructions.

Roundcube WebmailCVE-2020-35730
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-35730

Roundcube Webmail

Source reference: /product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2020-35730

Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event
#1307 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement