GCVE - cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:roundcube:webmail:0.5:*:*:*:*:*:*:*

part: a version: 0.5 update: *

Vendor	Roundcube (`e9332c9d-8d56-558e-b31a-ef4bbc8643b9`)
Product	Webmail (`aca6980c-c41a-59dc-91cb-067d061f918a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.611619
`pkg:github/roundcube/roundcubemail`	purl2cpe	2026-06-01 10:11:31.611620
`pkg:rpm/fedora/roundcubemail`	purl2cpe	2026-06-01 10:11:31.611622
`pkg:rpm/opensuse/roundcubemail`	purl2cpe	2026-06-01 10:11:31.611623

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-6172`	vulnerable	2026-06-08 05:04:55.549328	Details available steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code. Published: 2013-11-05T18:00:00.000Z Updated: 2024-08-06T17:29:42.979Z Open on db.gcve.eu Reference links http://trac.roundcube.net/ticket/1489382 http://roundcube.net/news/2013/10/21/security-updates-095-and-087/ http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-02-19 http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html http://www.debian.org/security/2013/dsa-2787	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-5645`	vulnerable	2026-06-08 05:04:52.913371	Details available Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. Published: 2013-08-29T10:00:00.000Z Updated: 2024-08-06T17:15:21.493Z Open on db.gcve.eu Reference links http://trac.roundcube.net/changeset/ce5a6496fd6039962ba7424d153278e41ae8761b/github http://trac.roundcube.net/changeset/93b0a30c1c8aa29d862b587b31e52bcc344b8d16/github http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html http://trac.roundcube.net/wiki/Changelog#RELEASE0.9.3 http://trac.roundcube.net/ticket/1489251	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1904`	vulnerable	2026-06-08 05:03:57.190395	Details available Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013. Published: 2014-02-08T00:00:00.000Z Updated: 2024-08-06T15:20:37.192Z Open on db.gcve.eu Reference links http://habrahabr.ru/post/174423/ http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/ http://lists.roundcube.net/pipermail/dev/2013-March/022328.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00080.html http://www.openwall.com/lists/oss-security/2013/03/28/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6121`	vulnerable	2026-06-08 05:02:59.568124	Details available Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. Published: 2013-02-24T21:00:00.000Z Updated: 2024-08-06T21:28:39.153Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2013-02/msg00051.html https://github.com/roundcube/roundcubemail/commit/74cd0a9b62f11bc07c5a1d3ba0098b54883eb0ba http://lists.opensuse.org/opensuse-updates/2013-09/msg00018.html http://sourceforge.net/news/?group_id=139281&id=310213 http://www.securityfocus.com/bid/57849	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4668`	vulnerable	2026-06-08 05:02:52.089634	Details available Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email. Published: 2012-08-25T10:00:00.000Z Updated: 2024-09-17T02:10:40.803Z Open on db.gcve.eu Reference links http://trac.roundcube.net/ticket/1488613 http://www.openwall.com/lists/oss-security/2012/08/20/9 https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32 http://www.openwall.com/lists/oss-security/2012/08/20/2 http://sourceforge.net/news/?group_id=139281&id=309011	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3507`	vulnerable	2026-06-08 05:02:10.277469	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1253`	vulnerable	2026-06-08 05:00:48.467908	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4078`	vulnerable	2026-06-08 04:59:28.990538	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2937`	vulnerable	2026-06-08 04:58:09.700998	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.