Report Name: AA25-141A_report.txt report
Generated: 2025-05-26 03:05:39

Product Name	Prevalence	U	C	H	M	L	A	Comment
WinRAR	0.8	1					1	WinRAR is a trialware file archiver utility for Windows, developed by Eugene Roshal of win.rar GmbH
Microsoft Outlook	0.6	1					1	Microsoft Outlook is a personal information manager software system from Microsoft, available as a part of the Microsoft 365 software suites
Roundcube	0.6	3					3	Roundcube is a web-based IMAP email client

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	2					2
Code Injection	0.97	1					1
Elevation of Privilege	0.85	1					1
Cross Site Scripting	0.8	1					1

Urgent (5)

1. Remote Code Execution - WinRAR (CVE-2023-38831) - Urgent [942]

Description: RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

2. Remote Code Execution - Roundcube (CVE-2020-12641) - Urgent [933]

Description: rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

3. Code Injection - Roundcube (CVE-2021-44026) - Urgent [927]

Description: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

4. Elevation of Privilege - Microsoft Outlook (CVE-2023-23397) - Urgent [906]

Description: Microsoft Outlook Elevation of Privilege Vulnerability

5. Cross Site Scripting - Roundcube (CVE-2020-35730) - Urgent [850]

Description: An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Critical (0)

High (0)

Medium (0)

Low (0)

Exploitation in the wild detected (5)

Remote Code Execution (2)

• WinRAR (CVE-2023-38831)
• Roundcube (CVE-2020-12641)

Code Injection (1)

• Roundcube (CVE-2021-44026)

Elevation of Privilege (1)

• Microsoft Outlook (CVE-2023-23397)

Cross Site Scripting (1)

• Roundcube (CVE-2020-35730)

Public exploit exists, but exploitation in the wild is NOT detected (0)

Other Vulnerabilities (0)