rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-7184 
Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T15:00:00.000Z
CVE-2013-7185 
PotPlayer 1.5.40688: .avi File Memory Corruption
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T14:45:42.000Z
CVE-2013-7186 
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T23:00:00.000Z
CVE-2013-7187 
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T23:00:00.000Z
CVE-2013-7188 
Cross-site scripting (XSS) vulnerability in KBKP Software HostBill before 2013-12-14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T23:00:00.000Z
CVE-2013-7189 
Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter to payinvoiceothers.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T23:00:00.000Z
CVE-2013-7190 
Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-20T23:00:00.000Z
CVE-2013-7191 
Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-21T00:00:00.000Z
CVE-2013-7192 
Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/news-events/newdetail.asp, or the (2) UserID or (3) Password to login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-21T00:00:00.000Z
CVE-2013-7193 
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-21T00:00:00.000Z
CVE-2013-7194 
Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Last name, (2) Lesson name, or (3) Course name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-21T00:00:00.000Z
CVE-2013-7195 
PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2013-7196 
static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified val[item_id] parameter for the publication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2013-7201 
WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z
CVE-2013-7202 
The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z
CVE-2013-7203 
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2013-7204 
Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-17T15:00:00.000Z
CVE-2013-7205 
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-14T18:00:00.000Z
CVE-2013-7209 
Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-30T15:00:00.000Z
CVE-2013-7216 
Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-24T22:00:00.000Z
CVE-2013-7217 
Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-26T18:00:00.000Z
CVE-2013-7219 
SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com_sexypolling) component before 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the answer_id[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T16:00:00.000Z
CVE-2013-7220 
js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7221 
The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7222 
config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7223 
Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7224 
Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7225 
Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7226 
Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-18T11:00:00.000Z
CVE-2013-7231 
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-30T02:00:00.000Z
CVE-2013-7232 
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-30T02:00:00.000Z
CVE-2013-7233 
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-30T02:00:00.000Z
CVE-2013-7234 
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7235 
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7236 
Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7239 
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T21:00:00.000Z
CVE-2013-7240 
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7241 
Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to inject arbitrary web script or HTML via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T11:00:00.000Z
CVE-2013-7242 
SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-31T11:00:00.000Z
CVE-2013-7243 
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php.  NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-17T15:00:00.000Z
CVE-2013-7245 
The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T20:00:00.000Z
CVE-2013-7246 
Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-30T18:00:00.000Z
CVE-2013-7247 
cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information (user names and password hashes) via the cmdWebGetConfiguration action in a TSA_REQUEST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T01:00:00.000Z
CVE-2013-7248 
Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password for the roleDiag account, which allows remote attackers to gain root privileges, as demonstrated using a cmdWebCheckRole action in a TSA_REQUEST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T01:00:00.000Z
CVE-2013-7249 
Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7250 
Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7251 
Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fibu/, (5) web/mobile/, (6) web/task/, or (7) web/wicket/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T11:00:00.000Z
CVE-2013-7252 
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-18T18:00:00.000Z
CVE-2013-7254 
Cross-site scripting (XSS) vulnerability in Opsview before 4.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7255 
Open redirect vulnerability in Opsview before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7256 
Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7257 
Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML via the Project Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7258 
Cross-site scripting (XSS) vulnerability in web2ldap 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "displaying group DN and entry data in group administration UI."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T15:00:00.000Z
CVE-2013-7259 
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7260 
Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-03T20:00:00.000Z
CVE-2013-7262 
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-05T20:00:00.000Z
CVE-2013-7263 
The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7264 
The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7265 
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7266 
The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7267 
The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7268 
The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7269 
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7270 
The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7271 
The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-06T11:00:00.000Z
CVE-2013-7273 
GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-29T14:00:00.000Z
CVE-2013-7274 
Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitrary web script or HTML via the title field in a wallpaper file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-08T15:00:00.000Z