---
title: "Security digest: June 2, 2020"
url: https://erroneo.us/security/2020-06-02/
description: "June 2, 2020 vulnerability digest: 1 brief (Roundcube CVE-2020-13965: XML Attachment XSS…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2020-06-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 2, 2020

1 editorial brief.

## Take stock

- Check exposure: Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024 . Anyone running Roundcube older than 1.4.5 or 1.3.12, including copies bundled in old hosting panels or appliances, and admins who re-added text/xml to client_mimetypes.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024](https://erroneo.us/security/briefs/roundcube-cve-2020-13965-xml-attachment-xss/index.md): Fixed in June 2020; if any Roundcube you run is still on 1.4.4 or older, this bug is the least of its problems, so upgrade it to a current release and check mailboxes for signs of theft.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2020-06-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt