Secunia

Some vulnerabilities have been discovered in PSCS VPOP3 Email Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "sess_folder" parameter in homeplus.html and to the "reason" parameter in index.html is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are confirmed in version 2.6.0j Standard and reported in version 2.6.0j Enterprise. Other versions may also be affected.

Solution
Use a proxy to filter malicious character sequences.

Provided and/or discovered by
Nenad Vijatov

Deep Links
Links available in Customer Area