MDaemon 8.0 - Content Filter Directory Traversal

MDaemon 8.0 - Content Filter Directory Traversal source: https://www.securityfocus.com/bid/14400/info MDaemon server is prone to a directory traversal vulnerability due to improper sanitization of user input. Failure to sanitize the filename and path may result in compromise of the file system...

[Full-disclosure] hehelol

hello, this is kcope and im bored .. soo sending an email with an attachment named aux to a Microsoft Outlook client crashes Outlook, can someone confirm that? heres some code to test that -----snip---------- use Net::SMTPauth; $smtp = Net::SMTPauth-new'mail.gmx.net'; $smtp-auth'CRAM-MD5',...

CVE-2005-2184

eRoom 6.x does not properly restrict files that can be attached, which allows remote attackers to execute arbitrary commands via a .lnk file...

CVE-2005-2175

The CVE-2005-2175 entry describes a cross-site scripting vulnerability in IBM Lotus Domino/Notes Web Access (DWA) and Lotus Notes mail: embedded JavaScript in HTML emails is executed automatically when opened, enabling an attacker to read/delete mail, access the user’s contact list, and potential...

CVE-2005-2176

Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

CVE-2005-2176

Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...

Cross site scripting in Lotus Notes web mail

When an HTML file attachment is opened in a lotus notes account via the web mail interface, the user sees that there is an attachment. Clicking the attachment does not prompt for saving or opening like in Yahoo, but opens the malicious HTML immediately, allowing for stealing of the LTPA session...

Lotus Notes mail server crossite scripting

HTML attachment content is not filtered in Web interface...

eRoom Multiple Security Issues

/ $ An open security advisory 9 - eRoom v6. Vulnerabilities 1: Bug Researcher: c0ntex - c0ntexbatgmail.com 2: Bug Released: July 06 2005 3: Bug Impact Rate: Medium / Hi 4: Bug Scope Rate: Remote $ This advisory and/or proof of concept code must not be used for commercial gain. Documentum eRoom...

Lotus Notes < 6.5.5 Web Mail Attachment HTML Injection

Binary data 3052.prm...

acroread -- buffer overflow vulnerability

An Adobe Security Advisory reports: A vulnerability within Adobe Reader has been identified. Under certain circumstances, remote exploitation of a buffer overflow in Adobe Reader could allow an attacker to execute arbitrary code. If exploited, it could allow the execution of arbitrary code under...

CVE-2002-1710

The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file...

CVE-2002-1710

BasiliX Webmail 1.1.0 (or lower) contains an Arbitrary File Disclosure vulnerability in the attachment handling of Compose Mail. The PHP-based script accepts a list of attachment names from the client but does not verify that those attachments were actually uploaded, allowing an attacker to retri...

CVE-2005-2007

Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier allows remote attackers to read or write arbitrary files via a .. dot dot in the id parameter to the 1 upload or 2 attachment scripts...

DEBIAN-CVE-2005-2007

Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier allows remote attackers to read or write arbitrary files via a .. dot dot in the id parameter to the 1 upload or 2 attachment scripts...

CVE-2005-1868

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension...

CVE-2005-1868

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension...

Microsoft Outlook Express 4.x5.x6.0 - Attachment Processing File Extension Obfuscation

Microsoft Outlook Express 4.x5.x6.0 - Attachment Processing File Extension Obfuscation source: https://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue...

Microsoft Outlook Express 4.x/5.x/6.0 - Attachment Processing File Extension Obfuscation

source: https://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email...

fswiki -- XSS problem in file upload form

A Secunia security advisory reports: A vulnerability has been reported in FreeStyle Wiki and FSWikiLite, which can be exploited by malicious people to conduct script insertion attacks. Input passed in uploaded attachments is not properly sanitised before being used. This can be exploited to injec...