rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-0215 
Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T18:00:00.000Z
CVE-2007-0216 
wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T22:00:00.000Z
CVE-2007-0217 
The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T22:00:00.000Z
CVE-2007-0218 
Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-0219 
Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0220 
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-0221 
Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-0222 
Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter.  NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined.  Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T01:00:00.000Z
CVE-2007-0223 
SQL injection vulnerability in shared/code/cp_functions_downloads.php in Nicola Asuni All In One Control Panel (AIOCP) before 1.3.009 allows remote attackers to execute arbitrary SQL commands via the download_category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0224 
SQL injection vulnerability in shopgiftregsearch.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginLastname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0225 
Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0226 
SQL injection vulnerability in wbsearch.aspx in uniForum 4 and earlier allows remote attackers to execute arbitrary SQL commands via the "by User" field (aka the TXbyuser parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0227 
slocate 3.1 does not properly manage database entries that specify names of files in protected directories, which allows local users to obtain the names of private files.  NOTE: another researcher reports that the issue is not present in slocate 2.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0228 
The DataCollector service in EIQ Networks Network Security Analyzer allows remote attackers to cause a denial of service (service crash) via a (1) &CONNECTSERVER& (2) &ADDENTRY& (3) &FIN& (4) &START& (5) &LOGPATH& (6) &FWADELTA& (7) &FWALOG& (8) &SETSYNCHRONOUS& (9) &SETPRGFILE&, or (10) &SETREPLYPORT& string to TCP port 10618, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0229 
Integer overflow in the ffs_mountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to CVE-2006-5679.  NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0230 
PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the install_dir parameter.  NOTE: CVE and third parties dispute this vulnerability because install_dir is defined before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0231 
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0232 
PHP remote file inclusion vulnerability in routines/fieldValidation.php in Jshop Server 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the jssShopFileSystem parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0233 
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2007-0235 
Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T18:00:00.000Z
CVE-2007-0236 
Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (kernel panic) and possibly execute arbitrary code via a crafted AppleTalk request that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T18:00:00.000Z
CVE-2007-0237 
The ndeb-binary feature in Lookup (lookup-el) allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-19T19:00:00.000Z
CVE-2007-0238 
Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-21T19:00:00.000Z
CVE-2007-0239 
OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-21T19:00:00.000Z
CVE-2007-0240 
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T18:00:00.000Z
CVE-2007-0242 
The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T16:00:00.000Z
CVE-2007-0243 
Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T22:00:00.000Z
CVE-2007-0244 
pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-11T03:55:00.000Z
CVE-2007-0245 
Heap-based buffer overflow in OpenOffice.org (OOo) 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T21:00:00.000Z
CVE-2007-0246 
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-29T21:00:00.000Z
CVE-2007-0247 
squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T18:00:00.000Z
CVE-2007-0248 
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T18:00:00.000Z
CVE-2007-0249 
Cross-site scripting (XSS) vulnerability in index.php in Nwom topsites 3.0 allows remote attackers to inject arbitrary web script or HTML via the o parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0250 
index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' (quote) character in the o parameter, which forces a SQL error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0251 
Integer underflow in the DecodeGRE function in src/decode.c in Snort 2.6.1.2 allows remote attackers to trigger dereferencing of certain memory locations via crafted GRE packets, which may cause corruption of log files or writing of sensitive information into log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0252 
Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0253 
Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expand_stack vulnerability from the Digital Armaments 20070110 pre-advisory.  NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities."  The developer also cites a past disclosure that was not proven
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0254 
Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0255 
XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0256 
VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0257 
Unspecified vulnerability in the expand_stack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities."  The developer also cites a past disclosure that was not proven.  As of 20070120, the original researcher has released demonstration code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0258 
Cross-site scripting (XSS) vulnerability in index.php in (1) Fastilo 2.0 and (2) Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0259 
Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via an invalid cat parameter to boxx/knowledgebase.asp, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0260 
PHP remote file inclusion vulnerability in index.php in Naig 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the this_path parameter.  NOTE: a reliable third party disputes this vulnerability because this_path is defined before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0261 
snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the imagefile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0262 
WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive information via an invalid m[] parameter, as demonstrated by obtaining the path, and obtaining certain SQL information such as the table prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0263 
Unspecified vulnerability in Total Commander before 6.5.6 allows user-assisted remote attackers to delete arbitrary files and corrupt a filesystem via a crafted RAR file.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0264 
Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long command line argument.  NOTE: this issue may cross privilege boundaries if an application automatically invokes Winzip32.exe for untrusted input filenames, as in the case of a file upload application.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0265 
Multiple cross-site scripting (XSS) vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pic parameter to custom/piczoom.asp, (2) the nocatname parameter to boxx/user-upload.asp, or (3) the iid parameter to indexes/newscomments.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0266 
SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2007-0267 
The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly corrupt other filesystems by mounting a crafted UNIX File System (UFS) DMG image that contains a corrupted directory entry (struct direct), related to the ufs_dirbad function.  NOTE: a third party states that the FreeBSD issue does not cross privilege boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T00:00:00.000Z
CVE-2007-0268 
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) the Advanced Queuing component and sys.dbms_aqsys.dbms_aq privileges (DB01), (2) Advanced Replication and sys.dbms_repcat_untrusted (DB07), and (3) Oracle Text and ctxload (DB15).  NOTE: Oracle has not publicly claims by reliable researchers that DB01 is for SQL injection in the SYS.DBMS_AQ_INV package, and DB07 is for a buffer overflow in the UNREGISTER_SNAPSHOT procedure in the DBMS_REPCAT_UNTRUSTED package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0269 
Unspecified vulnerability in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to the Change Data Capture and sys.dbms_cdc_subscribe privileges, aka DB02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0270 
Buffer overflow in SYS.DBMS_DRS in Oracle Database 9.2.0.7 and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via the GET_PROPERTY function in SYS.DBMS_DRS, aka DB03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0271 
Unspecified vulnerability in Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors related to the Log Miner component and sys.dbms_log_mnr privileges, aka DB04.  NOTE: Oracle has not disputed a reliable researcher claim that this is a buffer overflow in the ADD_LOGFILE procedure for the SYS.DBMS_LOGMNR package that allows code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0272 
Multiple buffer overflows in MDSYS.MD in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via unspecified vectors involving certain public procedures, aka DB05.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0273 
Unspecified vulnerability in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to XMLDB, aka DB06.  NOTE: as of 20070123, Oracle has not disputed claims by a reliable researcher that DB06 is for multiple cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0274 
Multiple unspecified vulnerabilities in Oracle Database 9.2.0.7 and 10.1.0.5 have unknown impact and attack vectors related to (1) Export and sys.dbms_logrep_util (DB08), and (2) Oracle Streams and sys.dbms_capture_adm_internal privileges (DB09).  NOTE: Oracle has not disputed reliable researcher claims that DB08 is for a buffer overflow in the GET_OBJECT_NAME procedure in the DBMS_LOGREP_UTIL package, and DB09 is for buffer overflows in the CREATE_CAPTURE, ALTER_CAPTURE, and ABORT_TABLE_INSTANTIATION procedures in SYS.DBMS_CAPTURE_ADM_INTERNAL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z
CVE-2007-0275 
Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T02:00:00.000Z