Vulnerability in Microsoft Windows 2000
CVE-2004-1319
The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.
EPSS: 0.269 (97.9th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Windows_2000
- Microsoft Windows_2003_server — versions enterprise, enterprise_64-bit, r2
- Microsoft Windows_98
- Microsoft Windows_98se
- Microsoft Windows_me
- Microsoft Windows_xp
- Nortel Ip_softphone_2050
- Nortel Mobile_voice_client_2050
- Nortel Optivity_telephony_manager
- N/a — versions n/a
References
- cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (US Government Resource, Patch, Third Party Advisory, x_refsource_CERT, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (Exploit, Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (x_refsource_MS, vendor-advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, Exploit, x_refsource_BUGTRAQ)