NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
Solution:
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
| Link | Tags |
|---|---|
| https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35982 | third party advisory not applicable |
| http://help.neobizbox.com/ | vendor advisory |