Threats tagged 'ghsa-8j98-q77q-pmv2'

A vulnerability in Evolution allows a remote attacker to execute arbitrary JavaScript by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the control, Evolution's JavaScript handler incorrectly assigns an attacker-controlled URL to an iframe, bypassing script execution protections. This can lead to arbitrary code execution within the mail-viewing context. The vulnerability has a CVSS score of 6.3 (medium severity).