449 matches found
Design/Logic Flaw
The iconvmimedecodeheaders function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring aka Multibyte String implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam...
CVE-2010-3407
IBM Lotus Domino server vulnerability CVE-2010-3407 exploitable via a stack-based overflow in MailCheck821Address (nnotes.dll) inside nrouter.exe. Remote attacker can execute arbitrary code by sending a long e-mail address in an ORGANIZER:mailto header of an iCalendar invitation. Affected: Lotus ...
SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules
Versions affected and proposed solutions Simple Gallery for Drupal 6.x This module creates a simple gallery using taxonomy and CCK imagefields. The module is vulnerable to a Cross Site Scripting XSS attack. This can be exploited by users with the ability to add taxonomy terms or tag content...
spamass-milter -- remote command execution vulnerability
The spamassassin milter plugin contains a vulnerability that can allow remote attackers to execute commands on affected systems. The vulnerability can be exploited trough a special-crafted email header when the plugin was started with the '-x' expand flag...
Fedora 10 : php-pear-Mail-1.1.14-5.fc10 (2009-12439)
Fix CVE-2009-4023, CVE-2009-4111 PEAR's Mail class did not properly escape content of mail header fields, when using the sendmail backend. A remote attacker could send an email message, with specially crafted headers to local user, leading to disclosure of content and potentially, to modification...
Fedora 12 : php-pear-Mail-1.1.14-5.fc12 (2009-12395)
Fix CVE-2009-4023, CVE-2009-4111 PEAR's Mail class did not properly escape content of mail header fields, when using the sendmail backend. A remote attacker could send an email message, with specially crafted headers to local user, leading to disclosure of content and potentially, to modification...
Sylpheed Email Header Buffer Overflow Vulnerability with non-ASCII Characters
Overview Sylpheed does not validate input data properly, which could lead to buffer overflow when it receives a message with the header containing non-ASCII characters. Impact An Attacker could execute arbitrary code with the privileges of the user running Sylpheed. Solution Please refer to the...
PHP 5.2.1 - Folded Mail Headers Email Header Injection
PHP 5.2.1 - Folded Mail Headers Email Header Injection source: https://www.securityfocus.com/bid/23145/info PHP is prone to an email-header-injection vulnerability because it fails to properly sanitize user-supplied input when constructing email messages. Exploiting this issue allows a malicious...
FreeBSD : typo3 -- email header injection (62b8f253-12d9-11dc-a35c-001485ab073e)
Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report : An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
typo3 -- email header injection
Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report: An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages...
Email header injection
A problem has been discovered where the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for. Component Type: TYPO3 Core Affected Versions: TYPO3 4.x below 4.0.5, 4.1beta, 4.1RC1, TYPO3 Versions 3.x Vulnerability Type: Email header...
[Full-disclosure] Advisory 14/2006: Dotdeb PHP Email Header Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Dotdeb PHP Email Header Injection Vulnerability Release Date: 2006/11/14 Last Modified: 2006/11/14 Author: Stefan Esser [email protected] Application: Dotdeb PHP 5.2.0 R...
CVE-2002-2214
The phpifimapmimeheaderdecode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service crash via an e-mail header with a long "To" header...
CVE-2002-2214
The CVE-2002-2214 issue affects PHP’s IMAP MIME header decoding function (php_imap_mime_header_decode) prior to PHP 4.2.2. An attacker-supplied email header with an excessively long To field can crash PHP, causing a denial of service. Remediation is to upgrade PHP to version 4.2.2 or newer (as in...
Design/Logic Flaw
Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
CVE-2006-2943
Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information...
security flaw
CRLF injection vulnerability in the mbsendmail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds LF in the "To" address argument...
CVE-2006-1225
CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy...
