rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-2860 
Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2861 
Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string, as demonstrated by bypassing a protection mechanism that removes only the "alert" string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2862 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2863 
Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2864 
Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2865 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a '\0' character, as demonstrated by using this character within a pathname on the drive containing the web root directory of a ColdFusion installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2866 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2867 
Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page, and then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2868 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2869 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2870 
The default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses cleartext for storage of credentials in a database, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2871 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2872 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory listing via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2873 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2874 
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T23:00:00.000Z
CVE-2014-2875 
The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T15:26:27.000Z
CVE-2014-2879 
Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-17T14:00:00.000Z
CVE-2014-2880 
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-17T14:00:00.000Z
CVE-2014-2881 
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-01T14:00:00.000Z
CVE-2014-2882 
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-01T14:00:00.000Z
CVE-2014-2884 
The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a (1) TC_IOCTL_OPEN_TEST or (2) TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-2885 
Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-2886 
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-18T10:00:00.000Z
CVE-2014-2888 
lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T14:00:00.000Z
CVE-2014-2889 
Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T00:00:00.000Z
CVE-2014-2890 
Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2014-2891 
strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-07T10:00:00.000Z
CVE-2014-2892 
Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2014-2893 
The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T14:00:00.000Z
CVE-2014-2894 
Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T14:00:00.000Z
CVE-2014-2896 
The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T15:41:55.000Z
CVE-2014-2897 
The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T15:41:59.000Z
CVE-2014-2898 
wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T15:42:02.000Z
CVE-2014-2899 
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2014-2900 
wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-22T14:00:00.000Z
CVE-2014-2901 
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:02:14.000Z
CVE-2014-2902 
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:05:02.000Z
CVE-2014-2903 
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T15:00:00.000Z
CVE-2014-2904 
wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:08:20.000Z
CVE-2014-2905 
fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T14:00:00.000Z
CVE-2014-2906 
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T15:35:01.000Z
CVE-2014-2907 
The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-24T10:00:00.000Z
CVE-2014-2908 
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-25T01:00:00.000Z
CVE-2014-2909 
CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-25T01:00:00.000Z
CVE-2014-2913 
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe.  NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-07T10:00:00.000Z
CVE-2014-2914 
fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T15:21:21.000Z
CVE-2014-2915 
Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-24T14:00:00.000Z
CVE-2014-2916 
Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-05T16:00:00.000Z
CVE-2014-2921 
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T22:00:00.000Z
CVE-2014-2922 
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T22:00:00.000Z
CVE-2014-2925 
Cross-site scripting (XSS) vulnerability in Advanced_Wireless_Content.asp in ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote attackers to inject arbitrary web script or HTML via the current_page parameter to apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T14:00:00.000Z
CVE-2014-2926 
kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-14T21:00:00.000Z
CVE-2014-2927 
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-15T14:00:00.000Z
CVE-2014-2928 
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-2933 
Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-2934 
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-2935 
costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-2936 
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-2938 
Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T20:00:00.000Z
CVE-2014-2939 
Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T19:00:00.000Z
CVE-2014-2940 
Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-15T10:00:00.000Z
CVE-2014-2941 
Cobham Sailor 6000 satellite terminals have hardcoded Tbus 2 credentials, which allows remote attackers to obtain access via a TBUS2 command.  NOTE: the vendor reportedly states "there is no possibility to exploit another user's credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-15T10:00:00.000Z
CVE-2014-2942 
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-22T10:00:00.000Z
CVE-2014-2946 
Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request element in an XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T19:00:00.000Z
CVE-2014-2947 
Cross-site scripting (XSS) vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T20:00:00.000Z