Threats tagged 'ghsa-53x6-q8p5-wm6r'

GFI KerioConnect versions before 10.0.9 Patch 2 contain a cross-site scripting (XSS) vulnerability in the Webmail component. This flaw allows a remote attacker to inject malicious HTML or script into a victim's authenticated Webmail session by sending a specially crafted email. The vulnerability arises from the link auto-formatter re-processing already-linked text and improperly handling quote characters, enabling script execution within the victim's session.