Back to Database
Status published
Medium
CVE-2007-0651
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37...
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via (1) e-mail messages and (2) the ID parameter to (a) right.asp, (b) Forms/MAI/list.asp, and (c) Forms/VCF/list.asp in mewebmail/base/default/lang/EN/.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-0651
Credits & Attribution
No credits recorded in the NVD database.
References
- http://securityreason.com/securityalert/2258
- http://secunia.com/advisories/23998
- http://www.mailenable.com/Professional20-ReleaseNotes.txt
- http://osvdb.org/33189
- http://osvdb.org/33190
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32480
- http://www.securityfocus.com/archive/1/460063/100/0/threaded
- http://osvdb.org/33188
- http://www.vupen.com/english/advisories/2007/0595
- http://secunia.com/secunia_research/2007-38/advisory/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32476
- http://www.securityfocus.com/bid/22554
More from mailenable
View All →CVE-2022-42136
Authenticated mail users, under specific circumstances, could add files with...
Unknown
0
CVE-2019-12927
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected...
Medium
6.1
CVE-2019-12926
MailEnable Enterprise Premium 10.23 did not use appropriate access control...
High
8.8
CVE-2019-12925
MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal...
High
8.1
CVE-2019-12924
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity...
Critical
9.8
Affected Vendor
mailenable
View all reports →Affected Software
mailenable professional
Vulnerable Versions:
1.0.004, 1.0.005, 1.0.006, 1.0.007, 1.0.008, 1.0.009, 1.0.010, 1.0.011, 1.0.012, 1.0.013, 1.0.014, 1.0.015, 1.0.016, 1.0.017, 1.1, 1.2, 1.2a, 1.5, 1.6, 1.7, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.51, 1.52, 1.53, 1.54, 1.72, 1.73, 1.82, 1.83, 1.84, 1.101, 1.102, 1.103, 1.104, 1.105, 1.106, 1.107, 1.108, 1.109, 1.110, 1.111, 1.112, 1.113, 1.114, 1.115, 1.116, 2.0, 2.1, 2.2, 2.32, 2.33, 2.34, 2.35, 2.351
Timeline
Official Publish:
February 15th, 2007
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.