5

CVE-2004-1319

Exploit

The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 2000 Updatesp1
Microsoft ≫ Windows 2000 Updatesp2
Microsoft ≫ Windows 2000 Updatesp3
Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Windows 2003 Server Versionenterprise Edition64-bit
Microsoft ≫ Windows 2003 Server Versionenterprise_64-bit
Microsoft ≫ Windows 2003 Server Versionr2 Edition64-bit
Microsoft ≫ Windows 2003 Server Versionr2 Editiondatacenter_64-bit
Microsoft ≫ Windows 2003 Server Versionstandard Edition64-bit
Microsoft ≫ Windows 98 Updategold
Microsoft ≫ Windows Xp Edition64-bit
Microsoft ≫ Windows Xp Editionhome
Microsoft ≫ Windows Xp Editionmedia_center
Microsoft ≫ Windows Xp Updategold Editionprofessional
Microsoft ≫ Windows Xp Updatesp1 Edition64-bit
Microsoft ≫ Windows Xp Updatesp1 Editionhome
Microsoft ≫ Windows Xp Updatesp1 Editionmedia_center
Microsoft ≫ Windows Xp Updatesp2 Editionhome
Microsoft ≫ Windows Xp Updatesp2 Editionmedia_center
Microsoft ≫ Windows Xp Updatesp2 Editiontablet_pc
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 35.5% 0.97
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
http://www.us-cert.gov/cas/techalerts/TA05-039A.html
Patch
Third Party Advisory
US Government Resource
http://www.kb.cert.org/vuls/id/356600
Patch
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/11950
Patch
Vendor Advisory
Exploit