CVE-2024-42008

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-420099.3A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of CVE-2024-42014.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting fr CVE-2024-420107.5mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren CVE-2024-420117.5The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.CVE-2024-420125.7GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user'CVE-2024-420136.4In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows adm CVE-2024-4201710.0An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenar CVE-2024-420187.7An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved CVE-2024-420198.0A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user int CVE-2024-42028.6In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiati CVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.CVE-2024-420216.5An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.