CVE-2018-25377: Buffer Copy without Checking Size of Input

Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload and paste it into the Name and Code fields of the...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439: Cross-Site Request Forgery (CSRF)

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

PT-2017-12552

Name of the Vulnerable Software and Affected Versions SocuSoft Flash Slideshow Maker Professional versions prior to v5.21 Description The issue arises when the advanced configuration is used, and the xml path HTTP parameter trusts user-supplied input. This is compounded by an unsafe XML...