Ability Mail Server is reported prone to multiple vulnerabilities that may allow a remote attacker to carry out cross-site scripting and denial of service attacks.
The server is prone to a cross-site scripting vulnerability that may allow an attacker to execute arbitrary HTML and script code in the browser of a vulnerable user.
It is reported that the mail server is also prone to a denial of service vulnerability. This issue presents itself when an attacker establishes about 150-200 connections to various services such as SMTP, POP3, View FeaturesIMAP4, WebMail etc.
These issue are reported to affect Ability Mail Server version 1.18, however, other versions may be affected as well.
Ability Mail Server contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'errormsg' parameter upon submission to the '_error' page. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
Upgrade to version 2.10 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.