CVE-2008-3823

Cross-site scripting XSS vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message...

CVE-2008-3823

Cross-site scripting XSS vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message...

FreeBSD : horde -- multiple vulnerabilities (7d239578-7ff2-11dd-8de5-0030843d3802)

Secunia reports : Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious people to conduct script insertion attacks Input via MIME attachment linking is not properly sanitised in the MIME library before being used. This can be exploited to execute...

Google Chrome畸形附件文件名拒绝服务漏洞

BUGTRAQ ID: 31031 CNCAN ID：CNCAN-2008090603 Google Chrome是一款谷歌公司新开发的WEB浏览器。 Google Chrome处理特殊构建附件文件名时存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 Google Chrome 0.2.149 27 目前没有解决方案提供： http://www.google.com/chrome ?php / Google Chrome 0.2.149.27 1583 Silent Crash PoC WHK - elhacker.net / $nombre =...

[oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS)

2008-012 Horde, Popoon frameworks common input sanitization errors XSS Two cross-site scripting XSS vulnerabilities were reported in Horde Framework. The first of which is that the Horde framework fails to properly sanitize the filename of MIME attachments on received emails. The second...

Horde 3.2 - MIME Attachment Filename Insufficient Filtering Cross-Site Scripting

source: https://www.securityfocus.com/bid/31110/info Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

FreeBSD Ports: ripmime

The remote host is missing an update to the system as announced in the referenced advisory. VID 85e19dff-e606-11d8-9b0a-000347a4fa7d OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

iDefense Security Advisory 07.31.08: Apple Mac OS X CoreGraphics PDF Type1 Font Integer Overflow Vulnerability

iDefense Security Advisory 07.31.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 31, 2008 I. BACKGROUND Mac OS X is a Unix operating system built from the XNU kernel. Mac OS X provides all the standard Unix capabilities and tools with an additional GUI component. For more informatio...

Code injection

Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 1.0.1 before bundle 36 and BlackBerry Enterprise Server 4.1 SP3 4.1.3 through 4.1 SP5 4.1.5 allows user-assisted remote attackers to execute arbitrary code via a crafted PDF...

[SECURITY] Fedora 9 Update: clamav-0.93.3-1.fc9

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

Sophos产品MIME附件处理拒绝服务漏洞

BUGTRAQ ID: 30110 Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。 Sophos杀毒软件处理畸形的数据时存在漏洞，如果用户使用Sophos杀毒软件扫描了0字节的MIME附件的话，就会导致应用程序意外终止。 Sophos Anti-Virus Sophos Pure Message for Unix Sophos Email Appliance Sophos ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sophos.com/...

VulnCheck KEV: CVE-2008-2244

Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited in the wild in July 2008, and as demonstrated by attachement.doc...

Lotus Notes Applix Graphics viewer BEGIN tag buffer overflow

Added: 06/06/2008 CVE: CVE-2007-5405 BID: 28454 OSVDB: 44194 Background Lotus Notes is the client for Lotus Domino servers. Lotus Notes uses the Autonomy KeyView library to display Applix Graphics .ag attachments. Problem A buffer overflow vulnerability when parsing the initial BEGIN tag in an...

Lotus Notes Applix Graphics viewer BEGIN tag buffer overflow

Added: 06/06/2008 CVE: CVE-2007-5405 BID: 28454 OSVDB: 44194 Background Lotus Notes is the client for Lotus Domino servers. Lotus Notes uses the Autonomy KeyView library to display Applix Graphics .ag attachments. Problem A buffer overflow vulnerability when parsing the initial BEGIN tag in an...

RHEL 4 : evolution28 (RHSA-2008:0515)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0515 advisory. Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management PIM...

Eudora 6.0.3 Attachment Spoofing Exploit (windows)

No description provided by source. !/usr/bin/perl -- use MIME::Base64; print "From: me\n"; print "To: you\n"; print "Subject: Eudora 6.0.3 on Windows spoof, LaunchProtect\n"; print "MIME-Version: 1.0\n"; print "Content-Type: multipart/mixed; boundary="zzz"\n"; print "\n"; print "This is a...

Buffer overflow

Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment...

CVE-2008-1108

Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment...

CVE-2008-1109

Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view aka the Calendars window...

CVE-2008-1109

Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view aka the Calendars window...