CVE-2012-1253

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:N/I:P/A:N
jpcertCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
roundcubewebmail
𝑥
≤ 0.6
roundcubewebmail
0.1
roundcubewebmail
0.1:alpha
roundcubewebmail
0.1:beta
roundcubewebmail
0.1:beta2
roundcubewebmail
0.1:rc1
roundcubewebmail
0.1:rc2
roundcubewebmail
0.1.1
roundcubewebmail
0.2
roundcubewebmail
0.2:alpha
roundcubewebmail
0.2:beta
roundcubewebmail
0.2.1
roundcubewebmail
0.2.2
roundcubewebmail
0.3
roundcubewebmail
0.3:beta
roundcubewebmail
0.3:rc1
roundcubewebmail
0.3.1
roundcubewebmail
0.4
roundcubewebmail
0.4:beta
roundcubewebmail
0.4.1
roundcubewebmail
0.4.2
roundcubewebmail
0.5
roundcubewebmail
0.5:beta
roundcubewebmail
0.5:rc
roundcubewebmail
0.5.1
roundcubewebmail
0.5.2
roundcubewebmail
0.5.3
roundcubewebmail
0.5.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
roundcube
bullseye (security)
1.4.15+dfsg.1-1+deb11u4
fixed
bullseye
1.4.15+dfsg.1-1+deb11u4
fixed
squeeze
no-dsa
bookworm
1.6.5+dfsg-1+deb12u4
fixed
bookworm (security)
1.6.5+dfsg-1+deb12u4
fixed
sid
1.6.9+dfsg-1
fixed
trixie
1.6.9+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
roundcube
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
ignored
natty
ignored
lucid
ignored
hardy
ignored