139 matches found
CVE-2023-28705 Openfind Mail2000 - XSS (Reflected Cross-site scripting)
Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it...
CVE-2023-0219
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks XSS when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML...
Shopware 日志信息泄露漏洞
Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware suffers from a log information disclosure vulnerability that stems from the logging module writing out all types of sent emails. An attacker with access to local system logs or a centralized log stor...
WordPress 4.1.x < 4.1.37 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS via wp-mail.php post by email. - An open redirect in wpnonceays. - Sender's email address is exposed in wp-mail.php. - A Cross-Site...
CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...
Researchers Uncover Kimusky Infra Targeting South Korean Politicians and Diplomats
The North Korean nation-state group Kimusky has been linked to a new set of malicious activities directed against political and diplomatic entities located in its southern counterpart since early 2022. Russian cybersecurity firm Kaspersky codenamed the cluster GoldDragon, with the infection chain...
CVE-2021-40128 Cisco Webex Meetings Email Content Injection Vulnerability
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameter...
CVE-2021-40128 Cisco Webex Meetings Email Content Injection Vulnerability
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameter...
Email Content Injection
github.com/apache/trafficcontrol is vulnerable to email content injection. An authenticated attacker is able to send an email with a malicious body impersonating Traffic Ops server with the specifically-crafted email, subject to /deliveryservices/request Traffic Ops endpoint...
TikTok: HTML Injection on tiktoktutorials via firstName parameter
HTML injection was found in tiktoktutorials endpoint which could have potentially allowed attackers to modify the content of the email and trick users into visiting malicious sites. We thank @siratsami for reporting this to our team...
CVE-2021-40377
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application...
Cross site scripting
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application...
CVE-2021-40377
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application...
MTN Group: HTML injection in email content during registration via FirstName/LastName parameter
Summary: Hi, I just found an issue when register account in https://mtnmobad.mtnbusiness.com.ng//auth/registerUser It allows an attacker to inject malicious text include html code in email content. Steps To Reproduce: 1. Go to https://uat.id.manulife.ca/mortgagecreditor/register?uilocales=en-CA. ...
Matrix Synapse 跨站脚本漏洞
Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability was previously present in Matrix Synapse version 1.27.0, which allowed an attacker to exploit the vulnerability to insert forged content into an email message...
Cisco Jabber Code Execution Vulnerability
Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber suffers from a code execution vulnerability that stems from an email content validation error. An attacker could exploit thi...
HCL iNotes Tag Phishing Vulnerability
HCL iNotes is a browsing client for accessing HCLDomino mail, contacts, calendar, scheduling and collaboration features. A label phishing vulnerability exists in HCL iNotes. The vulnerability stems from improper validation of email content. A remote, unauthenticated attacker could exploit the...
LiquidFiles Cross-Site Script Inclusion Vulnerability
LiquidFiles is a virtual appliance that helps companies and organizations send, receive and share large files quickly and securely. A cross-site scripting inclusion vulnerability exists in versions prior to LiquidFiles 3.3.19, which can be exploited by an attacker to obtain encrypted email conten...
Liquidfiles 跨站脚本漏洞
LiquidFiles is a virtual appliance that helps companies and organizations send, receive and share large files quickly and securely. A cross-site scripting inclusion vulnerability exists in versions prior to LiquidFiles 3.3.19, which can be exploited by an attacker to obtain encrypted email conten...