SugarCRM 5.2.0e - Remote Code Execution

SugarCRM 5.2.0e Remote Code Execution Name Remote Code Execution in SugarCRM Systems Affected Sugar CRM 5.2.0e and possibly earlier versions Severity High Impact CVSSv2 High 8/10, vector: AV:N/AC:L/Au:S/C:P/I:C/A:P Vendor http://www.sugarcrm.com Advisory...

E-mail attachment execution

Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...

BlackBerry Enterprise Server附件服务PDF过滤器未初始化堆代码执行漏洞

BUGTRAQ ID: 33250 BlackBerry Enterprise Server软件是BlackBerry企业解决方案中的一个组件，能够在无线设备、企业应用程序和无线网络之间起到中间连接的作用。 BlackBerry Enterprise Server所提供的附件服务没有正确地解析PDF文件中的数据流。由于一个逻辑错误，附件服务可能在堆上分配从未初始化过的对象指针数组。在释放包含这个数组的对象时，会删除这个数组中的每个指针。由于从正确的未初始化内存，攻击者可以控制为这个数组所分配的内存块，导致将攻击者控制的值用作对象指针，在删除这些指针的时候就会执行任意代码。...

clamav -- off-by-one heap overflow in VBA project parser

Advisory from Moritz Jodeit, November 8th, 2008: ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the clamd' process by sending an email...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration Suite ZCS 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a 1 .jpg or 2 .gif image attachment...

CVE-2008-1226

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration Suite ZCS 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a 1 .jpg or 2 .gif image attachment...

Apple Mail remote command execution vulnerability

Overview Apple Mail contains a vulnerability that may allow an attacker to execute arbitrary commands on OS X Leopdard 10.5 systems. Description Apple OS X uses resource forks to store structured data in files. Data forks are used to store unstructured data.The AppleDouble standard is specified i...

CVE-2007-1262

Multiple cross-site scripting XSS vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the 1 data: URI in an HTML e-mail attachment or 2 various non-ASCII character sets that are not properly filtered when viewed...

squirrelmail -- Cross site scripting in HTML filter

The SquirrelMail developers report: Multiple cross-site scripting XSS vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the 1 data: URI in an HTML e-mail attachment or 2 various non-ASCII character sets that a...

.uni Email Attachment Detection

Binary data 3945.prm...

.ost File Email Attachment Detection

Binary data 3943.prm...

Detection of .xls File Email Attachment

Binary data 3870.prm...

Detection of .zip File Email Attachment

Binary data 3871.prm...

Microsoft Windows Help存在多个漏洞

Microsoft Help WINHLP32.EXE处理.hlp文件存在多个远程代码执行和拒绝服务问题。 攻击者可以在WEB页上防止恶意帮助文件，或者通过EMAIL附件形式发送，诱使用户打开来触发此漏洞，成功利用此漏洞可以以进程权限执行任意指令。 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition...

Microsoft Security Advisory (925984) Vulnerability in PowerPoint Could Allow Remote Code Execution

Microsoft Security Advisory 925984 Vulnerability in PowerPoint Could Allow Remote Code Execution Published: September 27, 2006 Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft PowerPoint 2000, Microsoft PowerPoint 2002, Microsoft Offic...

CVE-2006-4951

Neon WebMail for Java before 5.08 is vulnerable to remote code execution: an attacker can send an email containing a JSP attachment that is stored under the web root with a predictable filename, allowing execution of arbitrary Java (JSP) code on the server. The affected component is Neon WebMail ...

CVE-2006-4057

Buffer overflow in the previewcreate function in gui.cpp in Mitch Murray Eremove 1.4 allows remote attackers to cause a denial of service application crash, and possibly execute arbitrary code, via a large email attachment...

CVE-2006-4057

Buffer overflow in the previewcreate function in gui.cpp in Mitch Murray Eremove 1.4 allows remote attackers to cause a denial of service application crash, and possibly execute arbitrary code, via a large email attachment...

CVE-2006-4057

The CVE-2006-4057 issue concerns Mitch Murray Eremove 1.4, where a buffer overflow in the preview_create function of gui.cpp can be triggered by a large email attachment. This vulnerability permits remote attackers to cause an application crash (DoS) and, per the description, may allow arbitrary ...

devhelp, seamonkey security update

CentOS Errata and Security Advisory CESA-2006:0609 Updated seamonkey packages that fix several security bugs in the mozilla package are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Seamonkey is a...