Loneferret

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parts of an SMTP e-mail message, including the `From`, `To`, or `Subject` header or the message `body`.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the body of an email. This could potentially lead to unauthorized actions on the affected system.

The issue allows remote attackers to inject arbitrary web script or HTML via the `From` or `Date` field in an email, potentially leading to cross-site scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML via the `To`, `From`, `Date`, or `Subject` field of an email, potentially leading to cross-site scripting (XSS) attacks.

The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the From field of an email.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the body of an email. This can lead to the execution of malicious scripts on the client-side.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `Subject` of an email. This could potentially lead to malicious actions on the affected system.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the body of an email. This could potentially lead to the execution of malicious scripts on the client-side.

The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body using various methods, including a JavaScript alert function with the fromCharCode method, a SCRIPT element, a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element, or an innerHTML attribute within an XML document.

The issue allows remote attackers to inject arbitrary web script or HTML via various components of an e-mail message, including the subject, body, and Date header. This can be achieved through different methods, such as using a JavaScript alert function with the fromCharCode method, incorporating a SCRIPT element, or utilizing a crafted SRC attribute of an IFRAME element. Additionally, attackers can exploit this by using a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element or by leveraging a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an element, such as an IMG element.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.

The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body. This can be achieved through the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the STYLE attribute of an IMG element, the CSS expression property in conjunction with multiple CSS comments within the STYLE attribute of an arbitrary element, or an innerHTML attribute within an XML document.

The issue allows remote attackers to inject arbitrary web script or HTML via various means, including an e-mail message body or subject, using techniques such as a `SCRIPT` element, crafted Cascading Style Sheets (CSS) expression properties, or specific attributes of elements like `IFRAME` or `META`. This can lead to cross-site scripting (XSS) attacks.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via an e-mail message body. Specifically, this can be achieved with a crafted SRC attribute of either an IFRAME element or a SCRIPT element.

The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body using various methods, including a SCRIPT element, a crafted SRC attribute of an IFRAME element, a crafted CONTENT attribute of an HTTP-EQUIV="Set-Cookie" META element, or an innerHTML attribute within an XML document.

The issue allows remote attackers to inject arbitrary web script or HTML via various means in an e-mail message body, including a `SCRIPT` element, a crafted Cascading Style Sheets (CSS) expression property, a CSS expression property in the `STYLE` attribute of an arbitrary element, an `ONLOAD` attribute of a `BODY` element, a crafted `SRC` attribute of an `IFRAME` element, a crafted `CONTENT` attribute of an `HTTP-EQUIV="refresh"` `META` element, or a `data:` URL in the `CONTENT` attribute of an `HTTP-EQUIV="refresh"` `META` element.

The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body using various methods, including a SCRIPT element, crafted Cascading Style Sheets (CSS) expressions, or specific attributes in HTML elements.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `id` parameter to several API endpoints, including "item delete.php", "item status.php", "item detail.php", "item modify.php", or "item position.php" in the "admin/" directory, or the `status` parameter to "admin/item status.php".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `priority` parameter in an "addTodo" action.

The issue is related to a buffer overflow in the BarCodeWiz BarCode 3.29 ActiveX control, specifically in the BarcodeWiz.dll file. This occurs when a long argument is passed to the `LoadProperties` method, allowing remote attackers to execute arbitrary code.