Microsoft Outlook Express 4.x/5.x/6.0 - Attachment Processing File Extension Obfuscation

source: https://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email...

CVE-2005-1678

CVE-2005-1678 affects Groove Virtual Office prior to 3.1 build 2338, prior to 3.1a build 2364, and Groove Workspace prior to 2.5n build 1871. The vulnerability arises from improper display of file extensions on attached or embedded files in a compound document, which may allow remote attackers to...

CVE-2005-1678: Undefined Security Weakness

Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 does not properly display file extensions on attached or embedded files in a compound document, which may allow remote attackers to trick users into executing malicious code...

CVE-2005-1601

MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomcat, which allows remote attackers to obtain sensitive information via a direct request for the file, such as MXServer.properties...

CVE-2005-1576: Undefined Security Weakness

The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP header to determine the file type, but saves the original file extension when "Save to Disk" is selected, which allows remote attackers to hide the real file types of downloaded files...

CVE-2005-0269

The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters...

[SCAN Associates Security Advisory] xoops 2.0.9.2 and below weak file extension validation

Summary: xoops 2.0.9.2 and below weak file extension validation Description =========== XOOPS is an extensible, OO Object Oriented, easy to use dynamic web content management system written in PHP. XOOPS is the ideal tool for developing small to large dynamic community websites, intra company...

security flaw

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

CVE-2005-0586

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

CVE-2005-0586: Undefined Security Weakness

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content...

CVE-2004-1404

The CVE-2004-1404 entry concerns the Attachment Mod 2.3.10 module for phpBB when used with Apache mod_mime. The vulnerability arises from improper handling of files with double extensions (e.g., .php.rar), which can enable remote attackers to upload and execute arbitrary code on the server. The p...

CVE-2004-1405

MediaWiki 1.3.8 and earlier, when used with Apache modmime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code...

CVE-2005-0269

The CVE-2005-0269 vulnerability affects GNUBoard versions 3.40 and earlier, where a file extension check only validates lowercase-letter extensions. This allows remote attackers to upload arbitrary files by using file extensions that contain uppercase letters. The root cause is a case-sensitive c...

CVE-2005-0269

The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters...

CVE-2005-0290: Undefined Security Weakness

NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension...

CVE-2005-0269: Improper Handling of Case Sensitivity

The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file extensions that include uppercase letters...

ArGoSoft FTP Server < 1.4.2.8 Shortcut File Extension Filter Bypass

Binary data 2604.prm...

CVE-2005-0190

CVE-2005-0190 describes a directory-traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier. A Real Metadata Packages (RMP) file with a FILENAME tag containing ".." sequences and ending with a question mark, combined with an allowed extension (e.g., .mp3), bypasses the file-extension...

STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard

STG Security Advisory: SSA-20041224-21 File extensions restriction bypass vulnerability in GNUBoard. Revision 1.0 Date Published: 2004-12-24 KST Last Update: 2005-01-03 Disclosed by SSR Team [email protected] Summary ======== GNUBoard is one of widely used web BBS applications in Korea...

CVE-2004-1545

UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache modmime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code...