CVE-2007-5456: Improper Control of Generation of Code

Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' question mark followed by a non-.exe filename after the .exe filename, as demonstrated by 1 .txt, 2 .cda, 3 .log, 4 .dif...

CVE-2004-1331: Undefined Security Weakness

The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command...