CVE-2018-18381

Z-BlogPHP 1.5.2.1935 (Zero) is affected by a stored XSS in zb_system/function/c_system_admin.php, exploitable via the Content-Type header during image attachment uploads. Affected component is the server-side upload handling in zb_system/function/c_system_admin.php; the issue allows injection of ...

Suspicious Image Attachment In Phishing Mail

Mail messages containing suspicious image file attachments were observed as part of various phishing campaigns. An attacker may use such phishing messages to entice users to disclose sensitive information such as usernames, passwords, and credit card details...

Mail.app Image Attachment Command Execution

No description provided by source. $Id: mailappimageexec.rb 10397 2010-09-20 15:59:46Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms o...

Microsoft Outlook Express 4.x/5.x/6.0 Plaintext Email Security Policy Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11447/info Microsoft Outlook Express is reported prone to a security policy bypass vulnerability. The vulnerability presents itself if an attached image file is referenced using a specially crafted CID URI. This will resu...

Seemingly malformed PNG file will cause JIRA to OOM within seconds

.atlassian.net was chain-OOM-ing earlier today. jworley was able to narrow it down to an image attachment on a particular issue. It's only a 300KB PNG file a screenshot from an Android device but it causes JIRA to OOM almost immediately. I've been able to replicate that behaviour on my jira-dev...

CVE-2012-6640

Cross-site scripting XSS vulnerability in Horde Internet Mail Program IMP before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565...

CVE-2012-6640

Cross-site scripting XSS vulnerability in Horde Internet Mail Program IMP before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565...

DEBIAN-CVE-2012-6640

Cross-site scripting XSS vulnerability in Horde Internet Mail Program IMP before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565...

CVE-2012-6640

Cross-site scripting XSS vulnerability in Horde Internet Mail Program IMP before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565...

Threat Outbreak Alert: Email Messages with Malicious Images on February 28, 2014

Medium Alert ID: 33114 First Published: 2014 February 28 19:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an image for the recipient. The email message attempts to convince the recipient to open the attachment to vi...

Threat Outbreak Alert: Email Messages with Malicious Attachments on January 7, 2014

Medium Alert ID: 32338 First Published: 2014 January 7 21:25 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an image for the recipient. The email message attempts to convince the recipient to open the attachment to view...

Threat Outbreak Alert: Email Messages with Malicious Attachment on June 11, 2014

Medium Alert ID: 32316 First Published: 2014 January 3 21:10 GMT Last Updated: 2014 June 12 13:56 GMT Version: 12 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an image for the recipient. The email message attempts to convince the...

Threat Outbreak Alert: Fake Picture Notification Email Messages on December 12, 2013.

Medium Alert ID: 32151 First Published: 2013 December 13 13:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a image for the recipient. The text in the email message attempts to convince the recipient to open the...

Cross site scripting

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

CVE-2012-1253

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

Eudora Japanese version stops working after the application crashes

Overview Eudora is a mail client from QUALCOMM. The Eudora Japanese version sold by Livedoor contains a vulnerability to crash, caused by previewing an email that has a corrupt image attachment. Impact Eudora Japanese version stops functioning, once crashed by opening an email message containing ...

Mail.app Image Attachment Command Execution

This module exploits a command execution vulnerability in the Mail.app application shipped with Mac OS X 10.5.0. This flaw was patched in 10.4 in March of 2007, but reintroduced into the final release of 10.5. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2006-3555

Multiple cross-site scripting XSS vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using editprofile.php to upload a 1 avatar or 2 forum image attachment that has a .gif or .jpg extension, and begins with a GIF header...

Apple Mail.App 10.5.0 (OSX) - Image Attachment Command Execution (Metasploit)

Apple Mail.App 10.5.0 OSX - Image Attachment Command Execution Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Apple Mail.App 10.5.0 (OSX) - Image Attachment Command Execution (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Mail.app Ima...