Description

Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

Remediation

References

CVE-2011-2937

Related Vulnerabilities

WordPress Plugin Canto Multiple Server-Side Request Forgery Vulnerabilities (1.7.0)

WordPress Plugin Event Calendar WD-Responsive Event Calendar Cross-Site Scripting (1.0.93)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4194)

MySQL CVE-2015-2582 Vulnerability (CVE-2015-2582)

WordPress Plugin Contact Form to DB by BestWebSoft-Messages Database For WordPress SQL Injection (1.7.0)

Severity

Medium

Classification

CVE-2011-2937 CWE-707

Tags

Missing Update Known Vulnerabilities