Axigen 10.5.0–4370c946 Cross Site Scripting

Exploit Title: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie = new URLxhr1.responseURL.search.split"="1; xhr2.open'PATCH', /api/v1/conversations/MQ/?h=$hcookie...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...

CVE-2022-31470

Summary of CVE-2022-31470 : The issue is an XSS vulnerability in Axigen Mobile WebMail (and Axigen WebMail entries in related docs) that allows an attacker with an active user session to execute arbitrary JavaScript and access mailbox content. Concrete details across connected sources indicate tw...