Improper input validation in Realnetworks Realplayer
CVE-2010-4396
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.
Affected products
- Realnetworks Realplayer — versions 11.0.2, 11.0.5, 11.0
- Realnetworks Realplayer_sp — versions 1.0.1, 1.0.0, 1.1.4
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)