CVE-2014-1861
EUVD-2014-192418.02.2014, 11:55
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| jetroplatforms | jetro_cockpit_secure_browsing | 4.3.1 |
| jetroplatforms | jetro_cockpit_secure_browsing | 4.3.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration