CVE

Id
11130  
CVE No.
CVE-2004-2704  
Status
Candidate  
Description
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.  
Phase
Assigned (20071006)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
78413 11130 CVE-2004-2704 BUGTRAQ:20040824 Hastymail security update  View
78414 11130 CVE-2004-2704 URL:http://archives.neohapsis.com/archives/bugtraq/2004-08/0322.html  View
78415 11130 CVE-2004-2704 CONFIRM:http://hastymail.sourceforge.net/security.php  View
78416 11130 CVE-2004-2704 BID:11022  View
78417 11130 CVE-2004-2704 URL:http://www.securityfocus.com/bid/11022  View
78418 11130 CVE-2004-2704 OSVDB:9131  View
78419 11130 CVE-2004-2704 URL:http://www.osvdb.org/9131  View
78420 11130 CVE-2004-2704 SECTRACK:1011054  View
78421 11130 CVE-2004-2704 URL:http://securitytracker.com/id?1011054  View
78422 11130 CVE-2004-2704 SECUNIA:12358  View
78423 11130 CVE-2004-2704 URL:http://secunia.com/advisories/12358  View
78424 11130 CVE-2004-2704 XF:hastymail-html-script-execution(17091)  View

Related JVN