Security Update for IceWarp eMail/WebMail Server
Version 9.4.2 of the IceWarp eMail/WebMail Server eliminates four security vulnerabilities. These include two cross-site scripting vulnerabilities, an SQL Injection vulnerability and a weakness in how the system sends mail to users. Under certain circumstances, an attacker could obtain the login credentials of a user.
- Cross Site Scripting in Email View, a RedTeam advisory.
- User-assisted Cross Site Scripting in RSS Feed Reader, a RedTeam advisory.
- SQL Injection in Groupware Component, a RedTeam advisory.
- Client-Side Specification of "Forgot Password" eMail Content, a RedTeam advisory.