Threats tagged 'ghsa-x85g-q7vc-7jh7'

GFI KerioConnect versions before 10.0.8 Patch 2 contain a stored cross-site scripting (XSS) vulnerability in the Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a crafted SVG email attachment that bypasses sanitization. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution upon opening the attachment. This can lead to theft of user credentials and mailbox contents. Proofpoint Threat Research has observed active exploitation in the wild targeting credential and mailbox theft.