CVE:CVE-2007-0651
CNNVD:CNNVD-200702-331
MailEnable个人版2.37版本之前的版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助(1)e-mail信息和(2)对(a)right.asp,(b)Forms/MAI/list.asp,和(c)mewebmail/base/default/lang/EN/中的Forms/VCF/list.asp的id参数，注入任意Javascript脚本。
solution:Upgrade mailenable mailenable_professional to a higher version than 1.0.004,1.0.005,1.0.006,1.0.007,1.0.008,1.0.009,1.0.010,1.0.011,1.0.012,1.0.013,1.0.014,1.0.015,1.0.016,1.0.017,1.1,1.2,1.2a,1.5,1.6,1.7,1.12,1.13,1.14,1.15,1.16,1.17,1.18,1.19,1.51,1.52,1.53,1.54,1.72,1.73,1.82,1.83,1.84,1.101,1.102,1.103,1.104,1.105,1.106,1.107,1.108,1.109,1.110,1.111,1.112,1.113,1.114,1.115,1.116,2.0,2.1,2.2,2.32,2.33,2.34,2.35,2.351,and avoid the version 1.0.004,1.0.005,1.0.006,1.0.007,1.0.008,1.0.009,1.0.010,1.0.011,1.0.012,1.0.013,1.0.014,1.0.015,1.0.016,1.0.017,1.1,1.2,1.2a,1.5,1.6,1.7,1.12,1.13,1.14,1.15,1.16,1.17,1.18,1.19,1.51,1.52,1.53,1.54,1.72,1.73,1.82,1.83,1.84,1.101,1.102,1.103,1.104,1.105,1.106,1.107,1.108,1.109,1.110,1.111,1.112,1.113,1.114,1.115,1.116,2.0,2.1,2.2,2.32,2.33,2.34,2.35,2.351