CVE-2024-21413

CVE-2024-21413 - Expect 스크립트 POC Microsoft Outlook 자격 증명 유출 및 원격 코드 실행 취약점 미리보기 패널을 통해 CVE-2023-21716과 연계 시 CVSS:3.1 9.8 / 8.5 Outlook은 외부 링크를 열 때 위험에 대해 경고해야 하지만, 그렇지 않습니다! 사용법: ./cve-2024-21413.sh mx.fqdn 포트 발신자 수신자 url ./cve-2024-21413.sh mail.mydomain.com 25 [email protected]...

CVE-2013-2977

IBM Lotus Notes PNG 整数溢出 - CVE-2013-2977 IBM Lotus Notes 是协作式客户端-服务器平台（以 IBM Lotus Domino 为应用服务器）的客户端。电子邮件客户端功能是其最重要且最常用的功能之一。IBM Lotus Notes 在解析电子邮件中嵌入的 PNG 图像文件时存在缺陷。一旦打开或仅预览恶意电子邮件，即可证明能够执行任意代码。 摘要 标题：IBM Lotus Notes PNG 整数溢出 CVE 编号：CVE-2013-2977...

Moniker-Link--CVE-2024-21413-

🔗 Moniker Link CVE-2024-21413 — Outlook 제로 클릭 취약점에 대한 실전 가이드 📌 1. 소개 CVE-2024-21413 은 흔히 Moniker Link 취약점 이라고 불리며, 사용자 상호작용 없이 공격자가 사용자 자격 증명을 유출 할 수 있게 하는 Microsoft Outlook의 치명적인 보안 결함입니다. 전통적인 피싱 공격과 달리 이 취약점은 이메일을 미리 보는 것만으로 트리거될 수 있어 기업 환경에서 특히 위험합니다. 이 문제는 Outlook이 moniker 링크 를 처리하는 방식에서 비롯되...

CVE-2026-9818

...

CVE-2026-9818

CVE-2026-9818 is rejected/not used; this entry does not represent an active vulnerability.

PT-2026-44369

Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services...

GHSA-26WG-9XF2-Q495 Novu has a XSS sanitization bypass

Summary XSS sanitization is incomplete, some attributes are missing such as oncontentvisibilityautostatechange=. This allows for the email preview to render HTML that executes arbitrary JavaScript, Details Sanitization is implemented here:...

October 跨站脚本漏洞

October is an open-source content management system CMS and online platform developed by October. Versions prior to October 3.7.14 and 4.1.10 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper rendering of HTML content in the event log email preview function,...

CVE-2023-43658

dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting XSS within the 'email preview' UI when a site has CSP disabled. Having CSP...

CVE-2023-43659

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the...

@inkeep/agents-manage-ui (>=0.0.0-dev-20251211233416, <=0.38.0), @react-email/preview-server (5.0.8) +1 more potentially affected by CVE-2025-55183 +2 more via next (16.0.9)

next NPM version 16.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @inkeep/agents-manage-ui =0.0.0-dev-20251211233416, =0.38.0 - @react-email/preview-server 5.0.8 - @tulip-systems/core 0.4.1 Source cves: CVE-2025-55183,...

EUVD-2021-34241

Malicious code in bioql PyPI...

EUVD-2023-48048

Malicious code in bioql PyPI...

EUVD-2023-48047

Malicious code in bioql PyPI...

CVE-2021-4414

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcalpreviewemails function. This makes it possible for unauthenticated attackers to generat...

PT-2025-20988 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions prior to the May 2025 updates Description: The issue is related to a use after free vulnerability in Microsoft Office, allowing an unauthorized attacker to execute code locally. This vulnerability can be exploited by...

CVE-2025-32426 Formie has a XSS vulnerability for email notification content for preview

Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means a delivered email. This would requir...

rami.io pretix 安全漏洞

rami.io pretix is a ticket store application for conferences, festivals, concerts, tech events, shows, exhibitions, workshops, bars, etc. from the German company rami.io. A security vulnerability exists in rami.io pretix version 2024.7.0 and earlier versions. An attacker can exploit the...

Cross site scripting

dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting XSS within the 'email preview' UI when a site has CSP disabled. Having CSP...

CVE-2023-43658

The CVE-2023-43658 entry describes a Cross-Site Scripting (XSS) flaw in the discourse-calendar plugin for the Discourse platform. The issue arises from improper escaping of event titles, which can trigger XSS in the email preview UI when CSP is disabled. This configuration is non-default, so most...