Tickets :: [#3751] XSS via X-color

04/10/2006 02:52:26 PM	Chuck Hagenbuch	Comment #2 State ⇒ Resolved	Reply to this comment
Fixed in HEAD and for IMP 4.1.1.

04/10/2006 02:09:10 PM	miksir (at) maker (dot) ru	Comment #1 State ⇒ Unconfirmed Priority ⇒ 1. Low Type ⇒ Bug Summary ⇒ XSS via X-color Queue ⇒ IMP	Reply to this comment
No checks in X-color field. (If show_account_colors on) X-Color field may be created by remote client . For example: X-color: "><!--a75c305b1c0a6022--><script>alert("hello");</script><"