AfterLogic WebMail Pro is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie- based authentication credentials other attacks are also possible. AfterLogic WebMail Pro 4.7.10 and prior versions are affected.

Reports indicate that the vendor addressed these issues in WebMail Pro 4.7.11, but Symantec has not confirmed this. Please contact the vendor for more information.

• http://www.afterlogic.com/
• http://www.securityfocus.com/bid/36605

---

Updated on 2015-03-25