cve.bz

roundcube webmail vulnerabilities in 2024, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 9.3CVE-2024-42009KEVExploitEPSS 83%

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in prog…

  2. 9.3CVE-2024-42008EPSS 34%

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerou…

  3. 9.8CVE-2024-37385EPSS 1.5%

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

  4. 6.1CVE-2024-37384EPSS 0.5%

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

  5. 6.1CVE-2024-37383KEVExploitEPSS 74%

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.