Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords
Security researchers have revealed vulnerabilities in the Roundcube webmail program that, in some situations, might be used to launch malicious JavaScript in a victim's web browser and take sensitive data from their account.
According to a report released this week by cybersecurity firm Sonar, an attacker can run arbitrary JavaScript on a victim's browser when they view a malicious email received by the attacker through Roundcube.
Attackers can use this vulnerability to send emails from the victim's account and steal emails, contacts, and the victim's email password.
Roundcube versions 1.6.8 and 1.5.8, which were made available on August 4, 2024, have fixed the three vulnerabilities after their responsible disclosure read more about Roundcube Webmail Flaws Allow Hackers to Steal ...