Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
12 versions affected across 2 products
@the_real_egg_f @ProtonMail I'm confused? A webmail client is better than the actual email service it self?! CVE-2025-68461 CVE-2025-49113 CVE-2025-68460 CVE-2024-42009 CVE-2024-37385 CVE-2023-5631 CVE-2021-44026 CVE-2020-12641 CVE-2017-16651
Post summary
The tweet simply lists multiple CVE identifiers without providing any additional context, details, or actionable information.
13 of 13 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 7.0 | - | - |
| OS | debian | debian_linux | 9.0 | - | - |
| App | roundcube | webmail | - | - | - |
| App | roundcube | webmail | 1.2.0 | - | - |
| App | roundcube | webmail | 1.2.1 | - | - |
| App | roundcube | webmail | 1.2.2 | - | - |
| App | roundcube | webmail | 1.2.3 | - | - |
| App | roundcube | webmail | 1.2.4 | - | - |
| App | roundcube | webmail | 1.2.5 | - | - |
| App | roundcube | webmail | 1.2.6 | - | - |
| App | roundcube | webmail | 1.3.0 | - | - |
| App | roundcube | webmail | 1.3.1 | - | - |
| App | roundcube | webmail | 1.3.2 | - | - |