Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
NetWin SurgeMail ‘Body’字段跨站脚本漏洞
Vulnerability Description
NetWin SurgeMail是新西兰NetWin公司的一款下一代电子邮件服务器。该服务器支持IMAP、POP3、SMTP等协议，并提供邮件杀毒、垃圾邮件过滤、邮件备份等功能。 NetWin SurgeMail中存在跨站脚本漏洞，该漏洞源于对用户提供的输入在用于动态生成内容之前未经正确的验证。攻击者利用该漏洞在受影响浏览器上下文中运行恶意的HTML和脚本代码，窃取基于cookie的认证证书并控制站点传达给用户的方式，也可能存在其他攻击。SurgeMail 6.0a4版本中存在漏洞，其他版本也可能受到影响
CVSS Information
N/A
Vulnerability Type
N/A