Secunia

Dejan Levaja has discovered some vulnerabilities in MDaemon Server WorldClient, which can be exploited by malicious people to conduct script insertion attacks.

Certain HTML tags in emails are not properly filtered before being displayed. This can be exploited to insert arbitrary HTML and script code via a malicious email, which is executed in a user's browser session in context of an affected site when the malicious email is viewed.

The vulnerabilities are confirmed in WorldClient HTTP Server and WorldClient DLL v10.0.1 as included in MDaemon PRO for Windows v10.0.1. Other versions may also be affected.

Solution
Update to MDaemon Server 10.0.2.

Provided and/or discovered by
Dejan Levaja, Network Security Solutions

Changelog
Further details available in Customer Area

Original Advisory
http://files.altn.com/MDaemon/Release/RelNotes_en.txt

Deep Links
Links available in Customer Area