Description

Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.

Remediation

References

CVE-2015-8105

Related Vulnerabilities

WordPress Plugin Social Count Plus Cross-Site Scripting (3.0.2)

WordPress Plugin Meta Slider and Carousel with Lightbox Cross-Site Request Forgery (1.6.2)

WordPress Plugin BJ Lazy Load Remote Code Execution (0.7.5)

WordPress Plugin WP Affiliate Disclosure Security Bypass (1.1.3)

WordPress Plugin WooCommerce HTML Injection (6.5.1)

Severity

Low

Classification

CVE-2015-8105

Tags

Missing Update Known Vulnerabilities