Matthieu Faou

**Name of the Vulnerable Software and Affected Versions** Afterlogic Aurora webmail versions 9.8.3 and below **Description** A cross-site scripting (XSS) issue exists in Afterlogic Aurora webmail. An attacker can send a specially crafted HTML email message containing JavaScript within an img HTML tag. This could allow a remote attacker to execute arbitrary JavaScript code within a webmail user's browser, potentially enabling access to user data. The attack vector involves sending a malicious email. **Recommendations** Update Afterlogic Aurora webmail to a version later than 9.8.3.

**Name of the Vulnerable Software and Affected Versions** MDaemon Email Server versions 25.0.1 and below **Description** A Stored Cross-Site Scripting (XSS) issue was discovered, allowing a remote attacker to send a specially crafted HTML e-mail message with JavaScript in an `img` tag. This could enable the attacker to load arbitrary JavaScript code in the context of a webmail user's browser window and access user data. **Recommendations** For MDaemon Email Server versions 25.0.1 and below, update to a version above 25.0.1 to resolve the issue. As a temporary workaround, consider restricting the use of HTML e-mail messages with JavaScript in the `img` tag until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MDaemon Email Server versions prior to 24.5.1c **Description** A Cross-Site Scripting (XSS) issue exists where a remote attacker can send an HTML email containing JavaScript within an `img` tag. This allows the attacker to load arbitrary JavaScript code in the context of a webmail user's browser window. This flaw has been actively exploited by the Russia-linked APT28 group in Operation RoundPress, targeting government and defense organizations across Eastern Europe, Africa, and South America to steal credentials and emails. **Recommendations** Update to version 24.5.1c or later.

**Name of the Vulnerable Software and Affected Versions** Roundcube versions 1.4.15 and earlier, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 **Description** The issue allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. The vulnerability has been exploited in the wild by groups such as Winter Vivern to target government entities and steal emails. The attackers send a specially crafted email message that includes a malicious payload, which is then executed on the victim's computer. **Recommendations** For versions 1.4.15 and earlier, update to version 1.4.15 or later. For versions 1.5.x before 1.5.5, update to version 1.5.5 or later. For versions 1.6.x before 1.6.4, update to version 1.6.4 or later. As a temporary workaround, consider disabling the `rcube washtml.php` function until a patch is available. Restrict access to the vulnerable `program/lib/Roundcube` module to minimize the risk of exploitation. Avoid using the `rcube washtml.php` behavior in the affected API endpoint until the issue is resolved.