6662 matches found
E-mail attachment execution
Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...
E-mail attachment execution
Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...
E-mail attachment execution
Added: 01/28/2009 Background This tool sends an e-mail attachment which, when executed, establishes a command connection. Limitations This tool requires a user to execute the e-mail attachment in order to succeed. This tool requires the IP address of a working mail server which allows relaying of...
CVE-2009-0219
The PDF distiller in the Attachment Service in Research in Motion RIM BlackBerry Enterprise Server BES 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 performs delete operations on uninitialized pointers, which allows user-assisted remote...
CVE-2009-0219
The PDF distiller in the Attachment Service in Research in Motion RIM BlackBerry Enterprise Server BES 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 performs delete operations on uninitialized pointers, which allows user-assisted remote...
BlackBerry Enterprise Server附件服务PDF过滤器未初始化堆代码执行漏洞
BUGTRAQ ID: 33250 BlackBerry Enterprise Server软件是BlackBerry企业解决方案中的一个组件，能够在无线设备、企业应用程序和无线网络之间起到中间连接的作用。 BlackBerry Enterprise Server所提供的附件服务没有正确地解析PDF文件中的数据流。由于一个逻辑错误，附件服务可能在堆上分配从未初始化过的对象指针数组。在释放包含这个数组的对象时，会删除这个数组中的每个指针。由于从正确的未初始化内存，攻击者可以控制为这个数组所分配的内存块，导致将攻击者控制的值用作对象指针，在删除这些指针的时候就会执行任意代码。...
iDefense Security Advisory 01.13.09: RIM BlackBerry Enterprise Server Attachment Service PDF Distiller 'symWidths' Heap Overflow Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 01.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 12, 2009 I. BACKGROUND The BlackBerry Enterprise Server is a suite of applications used to connect enterprise email and messaging services to BlackBerry...
iDefense Security Advisory 12.10.08: Microsoft Excel Malformed Object Memoy Corruption Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 12.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Dec 09, 2008 I. BACKGROUND Excel is the spreadsheet application included with Microsoft Corp.'s Office productivity software suite. More information is availabl...
[SECURITY] Fedora 8 Update: clamav-0.92.1-4.fc8
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
Attachment list in popup doesn't escape filenames causing XSS hole
The filenames in the attachment list of the link popup aren't being escaped. If you upload an attachment with a filename including html it could be executed...
Attachment list in popup doesn't escape filenames causing XSS hole
The filenames in the attachment list of the link popup aren't being escaped. If you upload an attachment with a filename including html it could be executed...
Attachment list in popup doesn't escape filenames causing XSS hole
The filenames in the attachment list of the link popup aren't being escaped. If you upload an attachment with a filename including html it could be executed...
clamav -- off-by-one heap overflow in VBA project parser
Advisory from Moritz Jodeit, November 8th, 2008: ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the clamd' process by sending an email...
PT-2008-6105 · Mybb · Mybb
Name of the Vulnerable Software and Affected Versions: MyBB versions 1.4.2 Description: The issue is related to insufficient randomness used to compose filenames of uploaded files used as attachments. This makes it easier for remote attackers to read these files by guessing filenames...
Drupal Core Multiple Vulnerabilities
Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
Discuz!/phpwind flash标签的xss
flash标签的xss在以前的是很流行的,以前只要随便一个调用外面的一个swf就ok了,现在的则都不可以直接使用调用外码的swf了,这个是因为一般都设置了allowScriptAccess12.比如dz的codz: dz60904\upload\forumdata\cache\cachebbcodes.php 同样出现在cacheviewthread.php cachepost.php cacheblog.php里 00017: 0 = 'marquee width="90%" behavior="alternate" scrollamount="3"\1/marquee', 00018...
CVE-2008-4020
Cross-site scripting XSS vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download...
MS08-056: Microsoft Office CDO Protocol (cdo:) Content-Disposition: Attachment Header XSS (957699)
The remote host is running a version of Microsoft Office that is subject to an information disclosure flaw. When a user clicks on a special CDO URL, an attacker could inject a client side script that could be used to disclose information. To succeed, the attacker would have to send a rogue CDO UR...
FreeBSD : drupal -- multiple vulnerabilities (12efc567-9879-11dd-a5e7-0030843d3802)
The Drupal Project reports : A logic error in the core upload module validation allowed unprivileged users to attach files to content. Users can view files attached to content which they do not otherwise have access to. If the core upload module is not enabled, your site will not be affected. A...
