Some vulnerabilities have been reported in IceWarp Web Mail, which can be exploited by malicious people to conduct cross-site scripting attacks, potentially compromise a vulnerable system and by malicious, local users to disclose some sensitive information.

1) Some unspecified input validation errors can be exploited to conduct cross-site scripting attacks.

2) An unspecified error with an unknown impact exists in "view.html".

3) Input passed to "send.html", "attachment.html", and "folderitem.html" is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

4) Input passed to "viewaction.html" isn't properly sanitised before being used to create directories and move or delete files. This can be exploited to create, move or delete arbitrary local directories / files using directory traversal attacks.

Combined with an issue where arbitrary content can be injected in "accounts.dat" using the page "accountsettings_add.html ", this can potentially be exploited to compromise a vulnerable system.

Solution
Update to the following versions:
Further details available to Secunia VIM customers

Provided and/or discovered by
1,2) Reported by vendor.
3,4) ShineShadow

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers