RSA with small decryption exponent
RSA without proper padding using randomness (plain old RSA) is not to be used in practice, and the attacks on small exponents assume plain old RSA, or a means of getting past the padding, such as the so-called million message attack.

The original attack on plain old RSA using such small exponents was due to Wiener. There has been further work showing that an even larger $d$ than $d&gt;N^{1/4}$ is required, such as work by Maitra and Sarkar. 

In addition, please see the extensive discussion in the question RSA with small exponents.