rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-0349 
Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.15 and 8.49.07 has unknown impact and remote attack vectors, aka PSE02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T22:00:00.000Z
CVE-2008-0350 
admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T23:00:00.000Z
CVE-2008-0351 
admin/config.php in Evilsentinel 1.0.9 and earlier allows remote attackers to bypass the CAPTCHA test by omitting the es_security_captcha parameter and not invoking captcha.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T23:00:00.000Z
CVE-2008-0352 
The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T23:00:00.000Z
CVE-2008-0353 
SQL injection vulnerability in visualizza_tabelle.php in php-residence 0.7.2 and 1.0 allows remote attackers to execute arbitrary SQL commands via the cognome_cerca parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0354 
Cross-site scripting (XSS) vulnerability in the chat client in IBM Lotus Sametime 7.5 and 7.5.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted message, which triggers code execution after a mouseover event initiated by the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0355 
SQL injection vulnerability in index.php in the forum module in PHPEcho CMS, probably 2.0-rc3 and earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action, a different vector than CVE-2007-2866.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0356 
Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0357 
Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0358 
SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0359 
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin.php or (2) index.php in photo/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0360 
Multiple SQL injection vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to execute arbitrary SQL commands via (1) the blogid parameter to index.php, (2) the user parameter to action.php, or (3) the field parameter to admin/plugins/table/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0361 
Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabla parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0362 
Cross-site scripting (XSS) vulnerability in gallery.php in Clever Copy 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the album parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0363 
Multiple SQL injection vulnerabilities in Clever Copy 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to postcomment.php and the (2) album parameter to gallery.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T21:00:00.000Z
CVE-2008-0364 
Buffer overflow in (1) BitTorrent 6.0 and earlier; and (2) uTorrent 1.7.5 and earlier, and 1.8-alpha-7834 and earlier in the 1.8.x series; on Windows allows remote attackers to cause a denial of service (application crash) via a long Unicode string representing a client version identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T22:00:00.000Z
CVE-2008-0365 
Multiple buffer overflows in CORE FORCE before 0.95.172 allow local users to cause a denial of service (system crash) and possibly execute arbitrary code in the kernel context via crafted arguments to (1) IOCTL functions in the Firewall module or (2) SSDT hook handler functions in the Registry module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T22:00:00.000Z
CVE-2008-0366 
CORE FORCE before 0.95.172 does not properly validate arguments to SSDT hook handler functions in the Registry module, which allows local users to cause a denial of service (system crash) and possibly execute arbitrary code in the kernel context via crafted arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T22:00:00.000Z
CVE-2008-0367 
Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T23:00:00.000Z
CVE-2008-0368 
onedcu in IBM Informix Dynamic Server (IDS) 10.x before 10.00.xC8 allows local users to create arbitrary files via the Trace file argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T23:00:00.000Z
CVE-2008-0369 
Multiple unspecified programs in IBM Informix Dynamic Server (IDS) 10.x before 10.00.xC8 allow local users to create arbitrary files by specifying the target file in the SQLIDEBUG environment variable, whose ownership is changed to the user invoking the programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T23:00:00.000Z
CVE-2008-0370 
Cross-site scripting (XSS) vulnerability in dohtaccess.html in cPanel before 11.17 build 19417 allows remote attackers to inject arbitrary web script or HTML via the rurl parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0371 
Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via (1) the mohit parameter to (a) inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via (2) the id parameter to (b) inc/usercp.php, related to functionz/usercp.php; or (3) the username parameter to (c) admin/index.php, related to functionz/first_process.php, or (d) index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0372 
8e6 R3000 Internet Filter 2.0.05.33, and other versions before 2.0.11, allows remote attackers to bypass intended restrictions via a fragmented HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0373 
Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0374 
OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attackers to obtain the administrative password by connecting to TCP port 5548 or 7777.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0375 
Unspecified vulnerability in OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 allows remote attackers to set the password and obtain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0376 
PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0377 
MicroNews allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0378 
Stack-based buffer overflow in SocksCap 2.40-051231 and earlier, when "Resolve all names remotely" is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0379 
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0380 
Buffer overflow in the Digital Data Communications RtspVaPgCtrl ActiveX control (RtspVapgDecoder.dll 1.1.0.29) allows remote attackers to execute arbitrary code via a long MP4Prefix property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0381 
Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting (XSS) in uploaded files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0382 
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0383 
Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0384 
OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a route label, which triggers a NULL pointer dereference when the return value from the rtlabel_id2name function is not checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-22T19:00:00.000Z
CVE-2008-0385 
SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with (1) statprt/js/request or (2) dyn/js/request in the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-29T19:00:00.000Z
CVE-2008-0386 
Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T22:00:00.000Z
CVE-2008-0387 
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-29T01:00:00.000Z
CVE-2008-0388 
SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T01:00:00.000Z
CVE-2008-0389 
Unspecified vulnerability in the serveServletsByClassnameEnabled feature in IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.25, 6.1 through 6.1.0.14, and 5.1.1.x before 5.1.1.18 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T01:00:00.000Z
CVE-2008-0390 
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T01:00:00.000Z
CVE-2008-0391 
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T01:00:00.000Z
CVE-2008-0392 
Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary code via a .dsr file with a long (1) ConnectionName or (2) CommandName line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T02:00:00.000Z
CVE-2008-0393 
Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabla parameter, a different vector than CVE-2008-0361.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T02:00:00.000Z
CVE-2008-0394 
Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function.  NOTE: some of these details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0395 
Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, which prints the contents of the $_SERVER superglobal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0396 
Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0397 
Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to comments.php and (2) an unspecified parameter to view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0398 
Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0399 
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arbitrary code via long arguments to the (1) SetPort and (2) SetIpAddress methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0400 
Cross-site scripting (XSS) vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter to default.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0401 
Buffer overflow in the logging functionality of the HTTP server in IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) before 5.1.0.3 Interim Fix 3 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an HTTP request with a long method string to port 443/tcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0402 
Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members of the repository's owning group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0403 
The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, which allows remote attackers to read and modify configuration via a direct request to SaveCfgFile.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0404 
Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs" summary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-23T11:00:00.000Z
CVE-2008-0405 
Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name, when requesting a URI composed of a "/?%0a" sequence followed by the data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0406 
HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0407 
HTTP File Server (HFS) before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0408 
HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0409 
Cross-site scripting (XSS) vulnerability in HTTP File Server (HFS) before 2.2c allows remote attackers to inject arbitrary web script or HTML via the userinfo subcomponent of a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0410 
HTTP File Server (HFS) before 2.2c allows remote attackers to obtain configuration and usage details by using an id element such as <id>%version%</id> in HTTP Basic Authentication instead of a username and password, as demonstrated by placing this id element in the userinfo subcomponent of a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-28T23:00:00.000Z
CVE-2008-0411 
Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-28T21:00:00.000Z
CVE-2008-0412 
The browser engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to the (1) nsTableFrame::GetFrameAtOrBefore, (2) nsAccessibilityService::GetAccessible, (3) nsBindingManager::GetNestedInsertionPoint, (4) nsXBLPrototypeBinding::AttributeChanged, (5) nsColumnSetFrame::GetContentInsertionFrame, and (6) nsLineLayout::TrimTrailingWhiteSpaceIn methods, and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-08T21:00:00.000Z
CVE-2008-0413 
The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-08T21:00:00.000Z
CVE-2008-0414 
Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-08T21:00:00.000Z