Ben Maurer

**Name of the Vulnerable Software and Affected Versions** University of Washington Pubcookie versions 3.0.0 through 3.1.1 University of Washington Pubcookie versions 3.2 through 3.2 before 3.2.1b University of Washington Pubcookie versions 3.3 before 3.3.0a **Description** The issue allows remote attackers to inject arbitrary web script or HTML via unspecified inputs, which can lead to cross-site scripting (XSS) attacks. **Recommendations** For University of Washington Pubcookie versions 3.0.0 through 3.1.1, update to version 3.2.1b or later. For University of Washington Pubcookie versions 3.2 through 3.2 before 3.2.1b, update to version 3.2.1b or later. For University of Washington Pubcookie versions 3.3 before 3.3.0a, update to version 3.3.0a or later.

**Name of the Vulnerable Software and Affected Versions** University of Washington Pubcookie versions 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 through 3.2.1b, 3.3 through 3.3.0a **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the mod pubcookie Apache application server module. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions 1.x, 3.0.0, 3.1.0, 3.1.1, update to version 3.2.1b or later. For versions 3.2 through 3.2.1b, update to version 3.2.1b or later. For versions 3.3 through 3.3.0a, update to version 3.3.0a or later.

**Name of the Vulnerable Software and Affected Versions** University of Washington Pubcookie versions 3.1.0 through 3.2, University of Washington Pubcookie versions 3.3 before 3.3.0a **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Microsoft IIS ISAPI filter of the University of Washington Pubcookie. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. **Recommendations** For University of Washington Pubcookie versions 3.1.0 through 3.2, update to version 3.2.1b or later. For University of Washington Pubcookie versions 3.3 before 3.3.0a, update to version 3.3.0a or later.

**Name of the Vulnerable Software and Affected Versions** SquirrelMail versions 1.4.0 through 1.4.5 **Description** The issue allows remote attackers to inject arbitrary web pages into the right frame via a URL in the `right frame` parameter. This has been referred to as a cross-site scripting (XSS) issue, but it is distinct from what is normally identified as XSS. **Recommendations** For SquirrelMail versions 1.4.0 through 1.4.5, consider restricting access to the `right frame` parameter to prevent arbitrary web page injection until a patch is available.