security flaw

CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the 1 Subject or 2 To parameter, as demonstrat...

security flaw

CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the 1 Subject or 2 To parameter, as demonstrat...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2007-1515

Multiple cross-site scripting XSS vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via 1 the email Subject header in thread.php, 2 the editquery parameter in search.php, or other unspecified parameters in search.php. NOTE:...

CVE-2006-7039: Undefined Security Weakness

The IMAP4 service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service crash via a message with a long subject field...

CVE-2007-1038: Undefined Security Weakness

Shemes.com Grabit 1.5.3, and possibly earlier, allows remote attackers to cause a denial of service application crash via a .nzb file with a subject field containing ';' semicolon characters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-1041: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a .nzb file with a long 1 group or 2 subject string...

CVE-2007-1037: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long subject field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

News File Grabber 4.1.0.1 - Subject Line Stack Buffer Overflow (1)

source: https://www.securityfocus.com/bid/22617/info News File Grabber is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Exploiting this issue allows...

BtitTracker 1.4 XSS

BtitTracker 1.4 xss Some fields are not sanitized for bad chars or words like javascript. =email field= When new user is registered you can put whatever you want and after that when still in mode "validating" you can change your email to something like "plaintext the field is 30 chars long so it ...

CVE-2007-0544

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

CVE-2007-0544

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

CVE-2007-0544: Undefined Security Weakness

Cross-site scripting XSS vulnerability in private.php in MyBB aka MyBulletinBoard allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949...

Design/Logic Flaw

Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service memory exhaustion and interrupted mail recovery via malformed e-mail header information, possibly related to 1 long subject lines or 2 large numbers of recipients in To or CC headers...

CVE-2006-6283

Multiple cross-site scripting XSS vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the subject field of 1 a private message PM or 2 a bulletin board post...

CVE-2006-6283

Multiple cross-site scripting XSS vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the subject field of 1 a private message PM or 2 a bulletin board post...

CVE-2006-6283: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the subject field of 1 a private message PM or 2 a bulletin board post...

CVE-2006-6159

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2006-6159: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2006-5902

viksoe GMail Drive shell extension allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by 1 a GMAILFS: 13;a;1 message with a new filename and a file attachment, which injects a new file into the filesystem; 2 a GMAILFS:...