The Web TransferCtrl Class 8 2 1 4 (iManFile.cab) as used in WorkSite Web 8.2 before SP1 P2 allows remote attackers to cause a denial of service (memory consumption) via a large number of SendNrlLink directives which opens a separate window for each directive.