rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1068 
The (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, (8) PEAP MSCHAPv2, (9) PEAP GTC, and (10) FAST authentication methods in Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client store transmitted authentication credentials in plaintext log files, which allows local users to obtain sensitive information by reading these files, aka CSCsg34423.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1069 
The memory management in VMware Workstation before 5.5.4 allows attackers to cause a denial of service (Windows virtual machine crash) by triggering certain general protection faults (GPF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T19:00:00.000Z
CVE-2007-1070 
Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1071 
Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image that triggers the overflow during decompression.  NOTE: this is a different issue than CVE-2006-3502 and CVE-2006-3503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T22:00:00.000Z
CVE-2007-1072 
The command line interface (CLI) in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier allows local users to obtain privileges or cause a denial of service via unspecified vectors.  NOTE: this issue can be leveraged remotely via CVE-2007-1063.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T22:00:00.000Z
CVE-2007-1073 
Static code injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary PHP code via the bgcolor parameter, which is inserted into mcrconf.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T22:00:00.000Z
CVE-2007-1074 
Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2) DownloadPath attributed in a (a) NBI file, or (3) a long group field in a (b) NZB file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T22:00:00.000Z
CVE-2007-1075 
TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large number of newline characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T22:00:00.000Z
CVE-2007-1076 
Multiple directory traversal vulnerabilities in phpTrafficA 1.4.1, and possibly earlier, allow remote attackers to include arbitrary local files via a .. (dot dot) in the (1) file parameter to plotStat.php and the (2) lang parameter to banref.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1077 
SQL injection vulnerability in page.asp in Design4Online UserPages2 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1078 
PHP remote file inclusion vulnerability in index.php in FlashGameScript 1.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the func parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1079 
Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a denial of service (crash) via a long response to a CWD command, which triggers the overflow when the user aborts the command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1080 
Multiple heap-based buffer overflows in TurboFTP 5.30 Build 572 allow remote servers to cause a denial of service via (1) long filename in a response to a LIST command, and (2) a long response to a CWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1081 
The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1082 
FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CPU consumption) via a long response to a PWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T23:00:00.000Z
CVE-2007-1083 
Buffer overflow in the Configuration Checker (ConfigChk) ActiveX control in VSCnfChk.dll 2.0.0.2 for Verisign Managed PKI Service, Secure Messaging for Microsoft Exchange, and Go Secure! allows remote attackers to execute arbitrary code via long arguments to the VerCompare method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T00:00:00.000Z
CVE-2007-1084 
Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T00:00:00.000Z
CVE-2007-1085 
Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by using an XSS vulnerability in google.com to extract the signature for the internal web server, then calling the "under" parameter in Advanced Search with the proper signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2007-1086 
Unspecified binaries in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allow local users to create or modify arbitrary files via unspecified environment variables related to "unsafe file access."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T22:00:00.000Z
CVE-2007-1087 
IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings, which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T22:00:00.000Z
CVE-2007-1088 
Stack-based buffer overflow in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allows local users to execute arbitrary code via a long string in unspecified environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T22:00:00.000Z
CVE-2007-1089 
IBM DB2 Universal Database (UDB) 9.1 GA through 9.1 FP1 allows local users with table SELECT privileges to perform unauthorized UPDATE and DELETE SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T22:00:00.000Z
CVE-2007-1090 
Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file, which triggers the crash when the user browses the folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T11:00:00.000Z
CVE-2007-1091 
Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T11:00:00.000Z
CVE-2007-1092 
Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document, wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1093 
Multiple unspecified vulnerabilities in JP1/Cm2/Network Node Manager (NNM) before 07-10-05, and before 08-00-02 in the 08-x series, allow remote attackers to execute arbitrary code, cause a denial of service, or trigger invalid Web utility behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1094 
Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript onUnload handlers that modify the structure of a document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1095 
Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attackers to run certain JavaScript code and access the location DOM hierarchy in the context of the next web site that is visited by a client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1096 
Cross-site scripting (XSS) vulnerability in ps_cart.php in VirtueMart before 20070116 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this issue might overlap CVE-2007-0376.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1097 
Unrestricted file upload vulnerability in the onAttachFiles function in the upload tool (inc/lib/attachment.lib.php) in Wiclear before 0.11.1 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to filename validation.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1098 
Multiple unspecified vulnerabilities in ScryMUD before 2.1.11 have unknown impact and attack vectors, possibly related to denial of service caused by a search that begins with a .* sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1099 
dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1100 
Directory traversal vulnerability in download.php in Ahmet Sacan Pickle before 20070301 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1101 
Multiple cross-site scripting (XSS) vulnerabilities in Photostand 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) message ("comment") or (2) name field, or the (3) q parameter in a search action in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1102 
Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' (quote) character in (1) a PHPSESSID cookie or (2) the id parameter in an article action in index.php, which reveal the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1103 
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1104 
PHP remote file inclusion vulnerability in top.php in PHP Module Implementation (PHP-MIP) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the laypath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1105 
PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1106 
PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1107 
SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users to execute arbitrary SQL commands via a cpg131_fav cookie.  NOTE: it was later reported that 1.4.10, 1.4.14, and other 1.4.x versions are also affected using similar cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1108 
PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the album parameter during a securealbum todo action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1109 
Multiple cross-site scripting (XSS) vulnerabilities in Phpwebgallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) login or (2) mail_address field in Register.php, or the (3) search_author, (4) mode, (5) start_year, (6) end_year, or (7) date_type field in Search.php, a different vulnerability than CVE-2006-1674.  NOTE: 1.6.2 and other versions might also be affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1110 
Directory traversal vulnerability in data/showcode.php in ActiveCalendar 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1111 
Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php, (2) js.php, (3) mysqlevents.php, (4) m_2.php, (5) m_3.php, (6) m_4.php, (7) xmlevents.php, (8) y_2.php, or (9) y_3.php in data/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2007-1112 
Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll) ActiveX controls, which allows remote attackers to "download" or delete arbitrary files via crafted arguments to the (1) DeleteFile, (2) StartBatchUploading, (3) StartStrBatchUploading, or (4) StartUploading methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-06T00:00:00.000Z
CVE-2007-1114 
The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T23:00:00.000Z
CVE-2007-1115 
The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T23:00:00.000Z
CVE-2007-1116 
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T23:00:00.000Z
CVE-2007-1117 
Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "file format vulnerability." NOTE: this information is based upon a vague pre-advisory with no actionable information.  However, the advisory is from a reliable source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1118 
Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path_to_smf parameter to (1) bridges/SMF/logout.php or (2) get_session_vars.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1119 
Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 (ZDM7SP1HP3) allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1120 
The (1) Import.LoadFromURL and (2) Export.asText.SaveToFile functions in TeeChart Pro ActiveX control (TeeChart7.ocx) allow remote attackers to download a crafted .tee file to an arbitrary location.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1121 
Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1122 
Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 and 1.01 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php, a variant of a SQL injection issue that was fixed in 1.01.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1123 
Multiple PHP remote file inclusion vulnerabilities in ZPanel 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the body parameter to templates/ZPanelV2/template.php or (2) the page parameter to zpanel.php.  NOTE: the zpanel.php vector may overlap CVE-2005-0793.2.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1124 
Directory traversal vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1125 
Cross-site scripting (XSS) vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1126 
Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1127 
Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. (dot dot) in the changetheme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1128 
shopkitplus allows remote attackers to obtain sensitive information via a request to (1) events.php with a curmonth[]=01 query string or (2) enc/stylecss.php with a changetheme[]= query string, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1129 
Multiple unrestricted file upload vulnerabilities in MTCMS 3.2 allow remote attackers to upload and execute files via (1) an avatar upload in an add_down action, or (2) an add_link action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1130 
PHP remote file inclusion vulnerability in sinagb.php in Sinapis Gastebuch 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1131 
PHP remote file inclusion vulnerability in sinapis.php in Sinapis Forum 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z
CVE-2007-1132 
Multiple cross-site scripting (XSS) vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) message and (2) title fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T02:00:00.000Z