CVE-2004-0613

osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory...

CVE-2004-1935

Cross-site scripting XSS vulnerability in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via onload, onmouseover, and other Javascript events in an e-mail attachment...

CVE-2004-0152

Multiple stack-based buffer overflows in 1 the encodemime function, 2 the encodeuuencode function, 3 or the decodeuuencode function for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames...

CVE-2004-0152

Multiple stack-based buffer overflows in 1 the encodemime function, 2 the encodeuuencode function, 3 or the decodeuuencode function for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames...

Add a generic HTML cleaning service

This will be able to be used by all components that need to display untrusted HTML: including HTML attachments, RSS feeds, and the html-include macro...

launchprotect.pl

Eudora 6.0.1 on Windows has LaunchProtect, to warn the user before running executable attachments. However this only works in the attach folder; using spoofed attachments, executables stored elsewhere may run without warning. In some setups, even executables in the attach folder may run without...

Eudora 6.0.1 LaunchProtect

Eudora 6.0.1 on Windows has LaunchProtect, to warn the user before running executable attachments. However this only works in the attach folder; using spoofed attachments, executables stored elsewhere may run without warning. In some setups, even executables in the attach folder may run without...

Qualcomm Eudora 6.0.16.1.1 - Attachment LaunchProtect Warning Bypass (2)

Qualcomm Eudora 6.0.16.1.1 - Attachment LaunchProtect Warning Bypass 2 source: https://www.securityfocus.com/bid/9101/info A problem has been identified in the implementation of LaunchProtect within Eudora. Because of this, it may be possible to trick users into performing dangerous actions. May...

Qualcomm Eudora 6.0.16.1.1 - Attachment LaunchProtect Warning Bypass (1)

Qualcomm Eudora 6.0.16.1.1 - Attachment LaunchProtect Warning Bypass 1 source: https://www.securityfocus.com/bid/9101/info A problem has been identified in the implementation of LaunchProtect within Eudora. Because of this, it may be possible to trick users into performing dangerous actions. May...

Qualcomm Eudora 5.x6.0 - Spoofed Attachment Line Denial of Service

Qualcomm Eudora 5.x6.0 - Spoofed Attachment Line Denial of Service source: https://www.securityfocus.com/bid/9026/info A vulnerability has been reported by Qualcomm that may be exploited by a remote attacker to cause the Eudora e-mail client to crash. It has been reported that a malicious email...

Qualcomm Eudora 5.x/6.0 - Spoofed Attachment Line Denial of Service

source: https://www.securityfocus.com/bid/9026/info A vulnerability has been reported by Qualcomm that may be exploited by a remote attacker to cause the Eudora e-mail client to crash. It has been reported that a malicious email that contains a spoofed attachment converted line will trigger this...

Eudora 6.0 attachment spoof, exploit

Eudora 6.0 was released recently; I tested the Windows version only. It still contains several vulnerabilities, the most serious being an execute-any-code bug. It is distressing that the "spoof and steal" bug was pointed out years ago; the execute-any-code bug in 5.2.1 was sent to Qualcomm on 29...

CVE-1999-1263

Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an e-mail message containing a uuencoded attachment that specifies the full pathname for the file to be modified, which is processed by uuencode in Metamail scripts such as sun-audio-file...

Microsoft Outlook 5.5/2000 - Web Access HTML Attachment Script Execution

source: https://www.securityfocus.com/bid/8113/info OWA contains a vulnerability that may result in attacker-supplied script code executing within the context of the mail interface when processing e-mail containing HTML message attachments. It is possible to prevent filtering of the attachment by...

iPlanet Messaging Server 5.05.1 - HTML Attachment Cross-Site Scripting

iPlanet Messaging Server 5.05.1 - HTML Attachment Cross-Site Scripting source: https://www.securityfocus.com/bid/7704/info It has been reported that iPlanet Messaging Server may be prone to cross-site scripting attacks. The problem is said to occur while processing HTML attachments received via...

iPlanet Messaging Server 5.0/5.1 - HTML Attachment Cross-Site Scripting

source: https://www.securityfocus.com/bid/7704/info It has been reported that iPlanet Messaging Server may be prone to cross-site scripting attacks. The problem is said to occur while processing HTML attachments received via e-mail. If successfully exploited, a malicious HTML file may be used to...

CVE-2002-1039

Directory traversal vulnerability in Double Choco Latte DCL before 20020706 allows remote attackers to read arbitrary files via .. dot dot sequences when downloading files from the Projects: Attachments feature...

CVE-2001-1373

Vulnerability (CVE-2001-1373) affects Zone Labs ZoneAlarm 2.6 and earlier, and ZoneAlarm Pro 2.6 and 2.4, where the MailSafe component does not block prohibited file types with long file names. Root cause: the filter fails to enforce type/name restrictions for attachments, enabling remote attacke...

Clearswift MAILsweeper protection bypass

If MIME-Version header is missed or binary encoding is used attachments are not recognized...

Qualcomm Eudora 5.0/5.1/6.0 - Long Attachment Filename Denial of Service (2)

source: https://www.securityfocus.com/bid/7026/info Eudora may crash when handling messages which contain attachments with excessively long filenames. This condition reportedly occurs when messages with malformed attachment filenames are stored in the user's mailbox, which could result in a...