CVE-2005-0586

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

CVE-2005-1105

The CVE-2005-1105 entry concerns JavaMail 1.3.2, where a directory-traversal flaw in MimeBodyPart.getFileName allows remote attackers to write arbitrary files by supplying a .. (dot dot) sequence in the Content-Disposition header. This identifies a vulnerability in the file-name handling path, en...

CVE-2005-1105

Removed by vendor...

JavaMail directory traversal

Content-Disposition header filename is not checked...

JavaMail allows directory traversal in attachments

INTRODUCTION The JavaMail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. The JavaMail API is implemented as a Java platform optional package and is also available as part of the Java 2 platform, Enterprise Edition. 2. SYNOPSIS...

security flaw

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

Download dialog spoofing using Content-Disposition header — Mozilla

Andreas Sandblad of Secunia Research demonstrated a method to spoof the download dialog for saving files by supplying a Content-Disposition header with a different extension than the extension visible in the link and download dialog. Users could be tricked into downloading a safe-looking file suc...

CVE-2002-0193

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error...

CVE-2002-0188

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error...

Microsoft Internet Explorer does not properly evaluate Content-Type and Content-Disposition headers

Overview A cross-domain scripting vulnerability exists in the way Microsoft Internet Explorer IE evaluates Content-Type and Content-Disposition headers and checks for files in the local browser cache. This vulnerability could allow a remote attacker to execute arbitrary script in a different...

CVE-2003-0531

CVE-2003-0531 maps to a vulnerability in Internet Explorer (IE) 5.01 SP3 through 6.0 SP1 where crafted Content-Type and Content-Disposition headers enable a remote attacker to access and execute script in the My Computer zone via the browser cache. The underlying flaw is IE’s handling of these he...

[NT] The Return of the Content-Disposition Vulnerability in IE

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2002-0024

CVE-2002-0024 affects Internet Explorer 5.01, 5.5 and 6.0. The issue allows an attacker to abuse Content-Disposition and Content-Type HTML headers to alter how a downloaded file’s name is displayed, potentially deceiving users into opening unsafe files. Exploitation details are not provided in th...

CVE-2002-0024

File Download box in Internet Explorer 5.01, 5.5 and 6.0 allows an attacker to use the Content-Disposition and Content-Type HTML header fields to modify how the name of the file is displayed, which could trick a user into believing that a file is safe to download...

PT-2002-2499 · Symantec +1 · Symantec Norton Antivirus +1

Name of the Vulnerable Software and Affected Versions: Symantec Norton AntiVirus NAV version 2002 Description: The issue allows remote attackers to bypass e-mail scanning via a filename in the Content-Type field with an excluded extension, but a malicious extension in the Content-Disposition fiel...

Microsoft Internet Explorer (MSIE) Content-Disposition vulnerabilities

Overview Microsoft Internet Explorer IE may handle executable content automatically, opening it with another application on the client host that may, in turn, instruct the operating system to execute the file. Description IE does not properly verify the Content-Disposition and Content-Type header...

CVE-2002-0193

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error...

CVE-2002-0188

Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error...

Microsoft Internet Explorer 5.0.1/6.0 - Content-Disposition Handling File Execution

source: https://www.securityfocus.com/bid/4752/info An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web server may provide content with misleading values in the content-type and...

CVE-2001-0727

Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."...