CVE-2004-1319

The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.
References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html Exploit Vendor Advisory
http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm
http://secunia.com/advisories/13482/ Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/356600 Patch Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/11950 Exploit Patch Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA05-039A.html Patch Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-013
https://exchange.xforce.ibmcloud.com/vulnerabilities/18504
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1114
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1701
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3851
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4758
http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html Exploit Vendor Advisory
http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm
http://secunia.com/advisories/13482/ Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/356600 Patch Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/11950 Exploit Patch Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA05-039A.html Patch Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-013
https://exchange.xforce.ibmcloud.com/vulnerabilities/18504
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1114
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1701
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3851
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4758
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nortel:ip_softphone_2050:*:*:*:*:*:*:*:*
cpe:2.3:a:nortel:mobile_voice_client_2050:*:*:*:*:*:*:*:*
cpe:2.3:a:nortel:optivity_telephony_manager:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_98se:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_me:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:home:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*

History

20 Nov 2024, 23:50

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html - Exploit, Vendor Advisory () http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html - Exploit, Vendor Advisory
References () http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm - () http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm -
References () http://secunia.com/advisories/13482/ - Patch, Vendor Advisory () http://secunia.com/advisories/13482/ - Patch, Vendor Advisory
References () http://www.kb.cert.org/vuls/id/356600 - Patch, Third Party Advisory, US Government Resource () http://www.kb.cert.org/vuls/id/356600 - Patch, Third Party Advisory, US Government Resource
References () http://www.securityfocus.com/bid/11950 - Exploit, Patch, Vendor Advisory () http://www.securityfocus.com/bid/11950 - Exploit, Patch, Vendor Advisory
References () http://www.us-cert.gov/cas/techalerts/TA05-039A.html - Patch, Third Party Advisory, US Government Resource () http://www.us-cert.gov/cas/techalerts/TA05-039A.html - Patch, Third Party Advisory, US Government Resource
References () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-013 - () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-013 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/18504 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/18504 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1114 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1114 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1701 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1701 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3464 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3464 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3851 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3851 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4758 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4758 -

Information

Published : 2004-12-15 05:00

Updated : 2024-11-20 23:50


NVD link : CVE-2004-1319

Mitre link : CVE-2004-1319

CVE.ORG link : CVE-2004-1319


JSON object : View

Products Affected

microsoft

  • windows_me
  • windows_98
  • windows_xp
  • windows_98se
  • windows_2000
  • windows_2003_server

nortel

  • mobile_voice_client_2050
  • ip_softphone_2050
  • optivity_telephony_manager