rainbutterfly/cve_corpus huggingface dataset:
CVE-2004-1628 
Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1629 
Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1630 
Cross-site scripting (XSS) vulnerability in the login form in Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to execute arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1631 
Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Worklist URL, then using the response times to infer the results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1632 
Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the arguments to wiki.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1633 
process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1634 
show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1635 
Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1636 
Heap-based buffer overflow in the WvTFTPServer::new_connection function in wvtftpserver.cc for WvTftp 0.9 allows remote attackers to execute arbitrary code via a long option string in a TFTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1637 
The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254, which displays a management interface and information on established connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1638 
Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1639 
Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1640 
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1641 
Heap-based buffer overflow in Titan FTP 3.21 and earlier allows remote attackers to cause a denial of service (crash) via a long FTP command such as (1) CWD, (2) STAT, or (3) LIST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1642 
WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service (crash) via a series of long MLIST commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1643 
WS_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path with a "../" sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1644 
Xedus 1.0 allows remote attackers to cause a denial of service (refuse connections) by connecting multiple times from the same IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1645 
Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username parameter to test.x, (2) username parameter to TestServer.x, or (3) param parameter to testgetrequest.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1646 
Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1647 
SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1648 
Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote attackers to inject arbitrary web script or HTML via the ShowMsg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1649 
Buffer overflow in Microsoft Msinfo32.exe might allow local users to execute arbitrary code via a long filename in the msinfo_file command line parameter.  NOTE: this issue might not cross security boundaries, so it may be REJECTED in the future.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1650 
D-Link DCS-900 Internet Camera listens on UDP port 62976 for an IP address, which allows remote attackers to change the IP address of the camera via a UDP broadcast packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1651 
Multiple cross-site scripting (XSS) vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Lastname fields during new user registration, or (3) the Schedule Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1652 
phpScheduleIt 1.0.0 RC1 does not clear administrative privileges if the administrator logs in as a normal user, which allows users with physical access to gain administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1653 
The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1654 
SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via cal_template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1655 
Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) CM_pid parameter in the comments module or (2) the subject or message fields in the notes module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1656 
CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the redirecturl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1657 
Cross-site scripting (XSS) vulnerability in the Activity and Events Viewer for Newtelligence DasBlog allows remote attackers to inject arbitrary web script or HTML via the (1) User Agent or (2) Referrer HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1658 
Kerio Personal Firewall 4.0 (KPF4) allows local users with administrative privileges to bypass the Application Security feature and execute arbitrary processes by directly writing to \device\physicalmemory to restore the running kernel's SDT ServiceTable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1659 
Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1660 
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1661 
MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1662 
YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1663 
Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1664 
Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet, which is not properly handled by the buffer overflow protection mechanism. NOTE: this issue might overlap CVE-2005-0430.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1665 
Cross-site scripting (XSS) vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the no parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1666 
Buffer overflow in the MSN module in Trillian 0.74i allows remote MSN servers to execute arbitrary code via a long string that ends in a newline character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1667 
Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long client response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1668 
Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid, (2) subid, or (3) catid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1669 
Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the (1) User name parameter to accountsettings.html or (2) Search string parameter to search.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1670 
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1671 
Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a direct request to (1) accountsettings_add.html or (2) topmenu.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1672 
attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1673 
accountsettings_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create text files with arbitrary content via the accountid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1674 
viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arbitrary files via the originalfolder parameter or (2) move arbitrary files via the messageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1675 
Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device name argument such as (1) COM1, (2) LPT1, (3) PRN, or (4) AUX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1676 
Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a crafted GG_MSG_IMAGE_REPLY message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1677 
pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname information in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1678 
Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modules via ".." sequences terminated by a %00 (null) character in the lang parameter, which can leak portions of the requested files if a compilation error message occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1679 
Directory traversal vulnerability in TwinFTP 1.0.3 R2 allows remote attackers to create arbitrary files via a .../ (triple dot) in the (1) CWD, (2) STOR, or (3) RETR commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1680 
application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET request, possibly triggering a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1681 
Multiple buffer overflows in (1) phrelay-cfg, (2) phlocale, (3) pkg-installer, or (4) input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow local users to gain privileges via a long -s (server) command line parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1682 
Format string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the QUOTE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1683 
A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a malicious io-graphics program before is executed by crrtrap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1684 
Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1685 
SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting to it from the same IP address as the administrator who is logged in, then accessing the setup_status.htm or status.HTM pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1686 
Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains an Internet Explorer formatted comment between the DOCTYPE tag and the HTML tag, as demonstrated using the DesignScience MathPlayer ActiveX plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1687 
CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1688 
Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port 3103.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1689 
sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1690 
Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML via the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1691 
The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1692 
Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1693 
PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1694 
Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1695 
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an extra leading / (slash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1696 
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1697 
The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for users that exist and users that do not exist, which could allow remote attackers to guess valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1698 
The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1699 
SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1700 
Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitrary HTML or web script via the Skin parameter, which is echoed in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z