Description

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

Remediation

References

CVE-2010-0464

Related Vulnerabilities

phpMyFAQ Improper Authorization Vulnerability (CVE-2014-6049)

WordPress Plugin Clipta Video Informer Cross-Site Scripting (1.0)

WordPress Plugin WordPress Shortcodes-Shortcodes Ultimate Unspecified Vulnerability (4.10.2)

WordPress Plugin Airtight Security & Features Formerly Redirect Editor And Security Unspecified Vulnerability (1.3)

YOURLS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3824)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2010-0464