CVE-2023-48115

SmarterMail 8495–8664 before 8747 is vulnerable to stored DOM XSS caused by an XSS protection mechanism being skipped when messageHTML and messagePlainText are set in the same request. Exploitation details are not provided in the documents, but the approved remediation is to upgrade to 8747 or la...

CVE-2023-48116: Improper Neutralization of Input During Web Page Generation

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment...

CVE-2023-48114

CVE-2023-48114 affects SmarterTools SmarterMail 8495–8664, before 8747. A stored XSS flaw arises from handling image/svg+xml and uploaded SVGs, where the app permits youtube.com variants including an @ attacker-controlled domain name. Impact is stored XSS in web context via SVG upload; no exploit...

CVE-2023-48116

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment...

CVE-2023-48115

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request...

CVE-2023-48116

CVE-2023-48116 affects SmarterTools SmarterMail 8495–8664; a crafted Calendar appointment description enables stored XSS. Root cause: input in calendar descriptions not properly sanitized, allowing script execution within the web client. Impact is stored XSS as described; exploitation details are...

Metasploit Weekly Wrap-Up

Authentication bypass in Wordpress Plugin WooCommerce Payments This week's Metasploit release includes a module for CVE-2023-28121 by h00die. This module can be used against any wordpress instance that uses WooCommerce payments 5.6.1. This module exploits an auth by-pass vulnerability in the...

SmarterTools SmarterMail Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution', 'Description' = %q This module exploits a...

SmarterTools SmarterTrack Cross-Site Scripting Vulnerability

SmarterTools SmarterTrack is a customer service software from SmarterTools UK. SmarterTools SmarterTrack version 100.0.8019.14010 is vulnerable to a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker cou...

CVE-2022-24384

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

CVE-2022-24385

A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

CVE-2022-24386

Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

CVE-2022-24385

A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

CVE-2022-24386

Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

CVE-2022-24384

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

Information disclosure

A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

Cross site scripting

Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

Cross site scripting

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

SmarterTools SmarterTrack 安全漏洞

SmarterTools SmarterTrack is a customer service software from SmarterTools UK. It improves customer service and reduces support costs. A security vulnerability exists in SmarterTools SmarterTrack 100.0.8019.14010 that originates from direct object access in SmarterTools SmarterTrack...

CVE-2022-24384

This entry documents a Cross-Site Scripting (XSS) vulnerability in SmarterTools SmarterTrack 100.0.8019.14010. The connected Nuclei template specifies the affected product and condition, confirming an XSS flaw in SmarterTrack. The underlying issue is data validation/output handling that allows ex...