CVE-2002-1997

ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension...

PHP-Nuke 6.0 - Web Mail Remote PHP Script Execution

PHP-Nuke 6.0 - Web Mail Remote PHP Script Execution source: https://www.securityfocus.com/bid/6399/info A vulnerability has been discovered in the PHP-Nuke Web Mail module. When a user opens an email that contains an attachment, the file will be put in a remotely accessible web directory. It has...

PHP-Nuke 6.0 - Web Mail Remote PHP Script Execution

source: https://www.securityfocus.com/bid/6399/info A vulnerability has been discovered in the PHP-Nuke Web Mail module. When a user opens an email that contains an attachment, the file will be put in a remotely accessible web directory. It has been reported that the vulnerable module fails to...

CVE-2002-1210

Qualcomm Eudora 5.1.1, 5.2, and possibly other versions stores email attachments in a predictable location, which allows remote attackers to read arbitrary files via a link that loads an attachment with malicious script into a frame, which then executes the script in the local browser context...

Fresh hole in W3Mail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Nth Dimension Security Advisory NDSA20021112 Date: 12th November 2002 Author: Tim Brown mailto:[email protected] URL: http://www.nth-dimension.org.uk/ / http://www.machine.org.uk/ Product: W3Mail up to and including 1.0.6 http://www.w3mail.org...

Microsoft Internet Explorer 6 - File Attachment Script Execution

source: https://www.securityfocus.com/bid/5450/info An error has been reported in Microsoft Internet Explorer 6, which may allow malicious file attachments to execute arbitrary code in the context of the local system. HTM files are associated with Internet Explorer. It is possible for an attacker...

CVE-2002-0455

IncrediMail stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames...

Qualcomm Eudora 56 - File Attachment Spoofing (2)

Qualcomm Eudora 56 - File Attachment Spoofing 2 source: https://www.securityfocus.com/bid/5432/info Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing...

Qualcomm Eudora 5/6 - File Attachment Spoofing (1)

source: https://www.securityfocus.com/bid/5432/info Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing malicious content, and in avoiding generating...

Microsoft Outlook Express 6 - .XML File Attachment Script Execution

Microsoft Outlook Express 6 - .XML File Attachment Script Execution source: https://www.securityfocus.com/bid/5350/info An error has been reported in Microsoft Outlook Express which may allow malicious XML file attachments to execute arbitrary code in the context of the local system. Code executi...

Medium security hole affecting W3Mail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I believe I've found a medium level security hole relating to the way W3Mail stores MIME attachments. I contacted the authors CascadeSoft - http://www.cascadesoft.com/ on the 19th, offering them 14 days to produce a fix, but have had no reply to...

PT-2002-1536 · Symantec · Norton Anti-Virus

Name of the Vulnerable Software and Affected Versions: Norton Anti-Virus NAV affected versions not specified Description: The issue allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignor...

CVE-2002-0198

Buffer overflow in plDaniels ripMime 1.2.6 and earlier, as used in other programs such as xamime and inflex, allows remote attackers to execute arbitrary code via an attachment in a long filename...

Outlook Express Attach Execution Exploit (img tag + innerHTML + TIF dos name)

Using some informations posted on Bugtraq in this week, I found a very simple way to exploit "download&execution" of an .EXE file, directly from Outlook Express. This is my report: When an HTML page attached into a message, is started, it runs in the security zone of "Temporary Internet Files" TI...

Lotus Notes does not adequately secure databases thereby permitting arbitrary user to extract file attachments via NSFDbReadObject function call

Overview Lotus Domino Servers 5.x, 4.6x, and 4.5x allow users to associate objects with documents in a database. While these objects appear to be a part of the document, they are actually stored as separate files. A vulnerability exist by which an intruder could view these objects regardless of t...

Code execution via Eudora attachments

It's possible to launch executable attached to e-mail message by specifying it as image source...

CVE-2000-0891

A default ECL in Lotus Notes before 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email...

Rit Research Labs The Bat! 1.53 - Microsoft Denial of Service Device Name Denial of Service

Rit Research Labs The Bat! 1.53 - Microsoft Denial of Service Device Name Denial of Service source: https://www.securityfocus.com/bid/4187/info The Bat! is an e-mail client for Microsoft Windows operating systems. A problem occurs with The Bat! when it is configured to save attachments seperately...

CVE-2001-1547

Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email attachments from forwarded messages, which could allow remote attackers to execute arbitrary code...

Lotus Notes: File attachments may be extracted regardless of document security

Hello, This is my first post to the list. I'll try to get this right. The short version is that file attachments and other objects may be extracted from Notes databases regardless of any author or reader fields on the documents the objects are attached to. This goes back to the structure of Notes...