CVE-2023-24839

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HGiga	MailSherlock	>= iSherlock-user-4.5, <= iSherlock-user-4.5-161; >= iSherlock-antispam-4.5, <= iSherlock-antispam-4.5-167

References

https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.htmlThird Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-24844.9The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers CVE-2023-248407.2HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with ad CVE-2023-248417.2HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote a CVE-2023-248425.3HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access CVE-2023-248437.5Transient DOS in Modem while triggering a camping on an 5G cell.CVE-2023-248447.8Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.CVE-2023-248459.8A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2023-248477.5Transient DOS in Modem while allocating DSM items.CVE-2023-248487.5Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.CVE-2023-248497.5Information Disclosure in data Modem while parsing an FMTP line in an SDP message.CVE-2023-24854.9An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 befo CVE-2023-248507.8Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.