Microsoft Office Malformed String Parsing Code Execution Vulnerability

Description Microsoft Office is prone to a code-execution vulnerability. This condition can occur when a malformed string within an Office file is parsed. This vulnerability is located in a shared library used by multiple Office applications, potentially allowing many different attack vectors. An...

US-CERT Technical Cyber Security Alert TA06-139A -- Microsoft Word Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-139A Microsoft Word Vulnerability Original release date: May 19, 2006 Last revised: -- Source: US-CERT Systems Affected Microsoft Word 2003 Microsoft Word XP 2002 Microsoft Word is includ...

Microsoft Word object pointer memory corruption vulnerability

Overview A memory corruption vulnerability in Microsoft Word could allow a remote attacker to execute arbitrary code with the privileges of the user running Word. Description Microsoft Word contains a memory corruption vulnerability. According to Microsoft Security Bulletin MS06-027:When a user...

CVE-2006-2036

CVE-2006-2036 affects iOpus Secure Email Attachments (SEA) 1.0. Root cause: improper handling of passwords that are repetitions of a substring, enabling an attacker to decrypt files by entering only the substring. Impact: partial confidentiality. No remediation details are provided in the supplie...

CVE-2006-2036: Undefined Security Weakness

iOpus Secure Email Attachments SEA, probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring...

Ubuntu 4.10 / 5.04 / 5.10 : imagemagick vulnerabilities (USN-246-1)

Florian Weimer discovered that the delegate code did not correctly handle file names which embed shell commands CVE-2005-4601. Daniel Kobras found a format string vulnerability in the SetImageInfo function CVE-2006-0082. By tricking a user into processing an image file with a specially crafted fi...

CVE-2006-0892

NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities...

CVE-2006-0662

Cross-site scripting XSS vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser...

USN-246-1: imagemagick vulnerabilities

Florian Weimer discovered that the delegate code did not correctly handle file names which embed shell commands CVE-2005-4601. Daniel Kobras found a format string vulnerability in the SetImageInfo function CVE-2006-0082. By tricking a user into processing an image file with a specially crafted fi...

Design/Logic Flaw

Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files...

CVE-2006-0332: Improper Control of Generation of Code

Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files...

CVE-2006-0091: Undefined Security Weakness

Cross-site scripting XSS vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline...

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection

Horde IMP 2.2.x3.2.x4.0.x - Email Attachments HTML Injection source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically...

Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection

source: https://www.securityfocus.com/bid/15730/info Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be...

CVE-2005-3573

Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service application crash...

CVE-2001-1547

Outlook Express 6.0 vulnerability: when the setting to block potentially virus-laden attachments is enabled, forwarded messages may bypass this and allow remote code execution. Affected component is attachments handling in forwarded email. The provided documents state the issue but do not specify...

CVE-2001-1542

NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments...

CVE-2001-1547

Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email attachments from forwarded messages, which could allow remote attackers to execute arbitrary code...

CVE-2002-1997

CVE-2002-1997 : ZoneAlarm Pro 3.0 MailSafe is described as allowing remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension. The provided sources confirm this description but do not offer concrete technical ...

CVE-2001-1542

CVE-2001-1542 concerns NAI WebShield SMTP 4.5 (and possibly 4.5 MR1a), where the product does not filter improperly MIME-encoded email attachments. The consequence described across connected records is that this could allow remote attackers to bypass filtering and potentially execute arbitrary co...