Websense Email Security Cross-Site Scripting and HTML Injection Vulnerabilities

Websense Email Security and Personal Email Manager are email security applications. Both applications use the Websense Email Security Web Administrator tool for online administration. The applications are exposed to cross-site scripting vulnerabilities and a HTML injection issue which affects the email "subject" header when it is held in a queue. Websense Email Security versions earlier than 7.1 Hotfix 4 and Websense Personal Email Manager versions earlier than 7.1 Hotfix 4 are affected by this issue.

Ref: http://sotiriu.de/adv/NSOADV-2009-003.txt http://kb.websense.com/display/4n/kb/article.aspx?aid=4786&searchstring=&;n=&tab=browse&bt=4n&s=

09.44.75 - CVE: CVE-2009-3748
Platform: Web Application - Cross Site Scripting