CVE-2024-6740

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Openfind	Mail2000 V7.0	>= all, < Patch 131
Openfind	Mail2000 V8.0	>= all, < Patch 044

References

https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdfExploit
https://www.twcert.org.tw/en/cp-139-7939-3423f-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7938-d9c97-1.htmlThird Party Advisory
https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdfExploit
https://www.twcert.org.tw/en/cp-139-7939-3423f-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7938-d9c97-1.htmlThird Party Advisory

Timeline

Published: Jul 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-67415.3Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vuln CVE-2024-67425.4AguardNet Technology's Space Management System does not properly filter user input, allowing remote attackers with regular privileges to inj CVE-2024-67439.8AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL CVE-2024-67449.8The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability.CVE-2024-67459.8A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the fil CVE-2024-67468.8A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown f CVE-2024-67477.5Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sen CVE-2024-67488.3Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injecti CVE-2024-67496.3Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive creden CVE-2024-67507.5The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability CVE-2024-67516.5The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is du CVE-2024-67525.4The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster