roundcube

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the roundcube package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Vulnerability	Vulnerable Version
L TEMP-1146838-FA492B	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-752355	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-6627BB	<1.6.5+dfsg-1+deb12u9
L TEMP-1146838-61F931	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-2D86BF	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-2C017C	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-252E75	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-1D84E4	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-192392	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-184AD1	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-17D26D	<1.6.5+dfsg-1+deb12u12
L TEMP-1146838-05CD08	<1.6.5+dfsg-1+deb12u12
M Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u11
H Arbitrary Command Injection	<1.6.5+dfsg-1+deb12u11
L Server-Side Request Forgery (SSRF)	<1.6.5+dfsg-1+deb12u11
L Arbitrary Command Injection	<1.6.5+dfsg-1+deb12u11
C Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u11
L Arbitrary Command Injection	<1.6.5+dfsg-1+deb12u11
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u11
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u11
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u11
L OS Command Injection	<1.6.5+dfsg-1+deb12u11
L TEMP-1144059-F202EA	*
L TEMP-1144059-D5626F	*
L TEMP-1144059-C03C30	*
L TEMP-1144059-B8D352	*
L TEMP-1144059-A4C2F7	*
L TEMP-1144059-9F08E7	*
L TEMP-1144059-6CA95B	*
L TEMP-1144059-6B0EAC	*
L TEMP-1144059-66595D	*
L TEMP-1144059-010809	*
L TEMP-1144059-007F1D	*
H Incorrect Permission Assignment for Critical Resource	<1.3.10+dfsg.1-1
L Authentication Bypass	<1.6.5+dfsg-1+deb12u10
L Server-Side Request Forgery (SSRF)	<1.6.5+dfsg-1+deb12u10
L Loop with Unreachable Exit Condition ('Infinite Loop')	<1.6.5+dfsg-1+deb12u10
L Allocation of Resources Without Limits or Throttling	<1.6.5+dfsg-1+deb12u10
H Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u10
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u10
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u9
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u9
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u9
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u9
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u9
L Always-Incorrect Control Flow Implementation	<1.6.5+dfsg-1+deb12u9
L Server-Side Request Forgery (SSRF)	<1.6.5+dfsg-1+deb12u9
L SQL Injection	<1.6.5+dfsg-1+deb12u9
H Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u8
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u8
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u8
L Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u8
L Access of Resource Using Incompatible Type ('Type Confusion')	<1.6.5+dfsg-1+deb12u8
M Incorrect Resource Transfer Between Spheres	<1.6.5+dfsg-1+deb12u8
L Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u8
L Arbitrary Argument Injection	<1.6.5+dfsg-1+deb12u8
H Deserialization of Untrusted Data	<1.6.5+dfsg-1+deb12u8
L Inclusion of Functionality from Untrusted Control Sphere	<1.6.5+dfsg-1+deb12u7
L Unprotected Alternate Channel	<1.6.5+dfsg-1+deb12u7
M Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u6
H Improper Encoding or Escaping of Output	<1.6.5+dfsg-1+deb12u6
H Deserialization of Untrusted Data	<1.6.5+dfsg-1+deb12u5
L CVE-2024-57004	*
L CVE-2024-42010	<1.6.5+dfsg-1+deb12u3
C Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u3
C Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u3
L CVE-2024-37384	<1.6.5+dfsg-1+deb12u2
M Cross-site Scripting (XSS)	<1.6.5+dfsg-1+deb12u2
M Cross-site Scripting (XSS)	<1.6.5+dfsg-1~deb12u1
M Cross-site Scripting (XSS)	<1.6.3+dfsg-1~deb12u1
M Cross-site Scripting (XSS)	<1.6.0+dfsg-1
C SQL Injection	<1.5.0+dfsg.1-1
M Cross-site Scripting (XSS)	<1.5.0+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.11+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.10+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.5+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.5+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.8+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.7+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.5+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.5+dfsg.1-1
C OS Command Injection	<1.4.4+dfsg.1-1
C Directory Traversal	<1.4.4+dfsg.1-1
M Cross-site Request Forgery (CSRF)	<1.4.4+dfsg.1-1
M Cross-site Scripting (XSS)	<1.4.4+dfsg.1-1
H CVE-2019-15237	<1.5.0+dfsg.1-1
M Cleartext Transmission of Sensitive Information	<1.3.10+dfsg.1-1
M Cross-site Scripting (XSS)	<1.3.8+dfsg.1-1
H Information Exposure	<1.3.8+dfsg.1-1
H Files or Directories Accessible to External Parties	<1.3.3+dfsg.1-1
M Cross-site Scripting (XSS)	<1.6.4+dfsg-1~deb12u1
H Improper Input Validation	<1.3.6+dfsg.1-1
H Improper Privilege Management	<1.2.3+dfsg.1-4
M Cross-site Scripting (XSS)	<1.2.3+dfsg.1-3
H Improper Access Control	<1.2.3+dfsg.1-1
M Cross-site Scripting (XSS)	<1.2.0+dfsg.1-1
H Cross-site Request Forgery (CSRF)	<1.1.5+dfsg.1-1
M Cross-site Scripting (XSS)	<1.2.1+dfsg.1-1
M Cross-site Scripting (XSS)	<1.1.5+dfsg.1-1
M Directory Traversal	<1.1.2+dfsg.1-1
M Cross-site Scripting (XSS)	<1.1.2+dfsg.1-1
H Directory Traversal	<1.1.4+dfsg.1-1
L Cross-site Scripting (XSS)	<1.1.3+dfsg.1-1
M Information Exposure	<1.1.2+dfsg.1-1
M Cross-site Scripting (XSS)	<1.1.2+dfsg.1-1
H Out-of-Bounds	<1.1.1+dfsg.1-2
H Arbitrary Code Injection	<1.1.1+dfsg.1-2
M Cross-site Scripting (XSS)	<0.9.5+dfsg1-4.2
M Cross-site Request Forgery (CSRF)	<1.1.1+dfsg.1-2
H SQL Injection	<0.9.4-1.1
M Cross-site Scripting (XSS)	<0.9.4-1
M Directory Traversal	<0.7.2-9
M Cross-site Scripting (XSS)	<0.7.2-4
M Cross-site Scripting (XSS)	<0.7.2-4
L Cross-site Scripting (XSS)	<0.7-1
M Resource Management Errors	<0.6+dfsg-1
M Cross-site Scripting (XSS)	<0.5.4+dfsg-1
M Improper Input Validation	<0.5.1-1
L Improper Input Validation	<0.5.1-1
M Information Exposure	<0.3.1-3
M Cross-site Request Forgery (CSRF)	<0.3-1
M Cross-site Request Forgery (CSRF)	<0.3-1
M Cross-site Scripting (XSS)	<0.2~stable-1
H Resource Management Errors	<0.1.1-10
C Arbitrary Code Injection	<0.1.1-9
M Cross-site Scripting (XSS)	<0.1~rc2-6