CVEvulnerability

CVE-2004-1319

5.0 MEDIUM Published 2004-12-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-12-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.

Affected configurations

• nortel ip softphone 2050 • nortel mobile voice client 2050 • nortel optivity telephony manager • microsoft windows 2000 • microsoft windows 2003 server enterprise • microsoft windows 2003 server enterprise 64-bit • microsoft windows 2003 server r2 • microsoft windows 2003 server standard • microsoft windows 2003 server web • microsoft windows 98 • microsoft windows 98se • microsoft windows me • microsoft windows xp

References