Description

Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.

Remediation

References

CVE-2013-5645

Related Vulnerabilities

Vanilla Forums Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-0909)

Oracle HTTP Server Other Vulnerability (CVE-2020-35166)

WordPress Plugin Accordion Shortcodes Cross-Site Scripting (2.4.2)

WordPress Plugin RegistrationMagic-Custom Registration Forms, User Registration, Payment, and User Login Multiple Vulnerabilities (4.6.0.1)

WordPress Plugin Buckets Cross-Site Scripting (0.1.9.2)

Severity

Medium

Classification

CVE-2013-5645 CWE-707

Tags

Missing Update Known Vulnerabilities