Published: 19/07/2013 Updated: 08/12/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 436

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and previous versions, as used in WordPress prior to 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote malicious users to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wordpress wordpress 3.0.1
wordpress wordpress 3.0.2
wordpress wordpress 3.1.2
wordpress wordpress 3.1.3
swfupload project swfupload 1.0.2
swfupload project swfupload 2.0.2
wordpress wordpress 3.0.3
wordpress wordpress 3.0.4
wordpress wordpress 3.1.4
wordpress wordpress 3.2
swfupload project swfupload 2.1.0
wordpress wordpress 3.0.5
wordpress wordpress 3.0.6
wordpress wordpress 3.2.1
wordpress wordpress 3.3
swfupload project swfupload 2.2.0
swfupload project swfupload
wordpress wordpress -
wordpress wordpress 3.0
wordpress wordpress 3.1
wordpress wordpress 3.1.1
wordpress wordpress
tinymce image manager 1.1

source: wwwsecurityfocuscom/bid/54245/info SWFUpload is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the attacker to steal cooki ...

WordPress versions 25 through 331 suffer from a cross site scripting vulnerability in swfuploadswf ...

CMS Dotclear version 244 suffers from cross site scripting and content spoofing vulnerabilities ...

Dotclear, InstantCMS, AionWeb, and Dolphin all include a version of swfuploadswf that suffers from a cross site scripting vulnerability ...

WordPress WP-E-Commerce plugin version 3895 suffers from local file inclusion, cross site scripting, cross site request forgery, file upload, and code execution vulnerabilities ...

SWFUpload - Fork from SWFUpload Build 2.2.1

SWFUpload SWFUpload - Fork from SWFUpload Build 221 Original Project at: codegooglecom/p/swfupload/ LICENCE Copyright (C) 2006-2007 Lars Huring, Olov Nilzén and Mammon Media Copyright (C) 2007-2008 Jake Roberts Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software&qu

A fork of the long-abandoned SWFUpload project, maintained by WordPress and others to ensure that a secure version of SWFUpload exists. Report security vulnerabilities to swfupload-security@wordpress.org.

SWFUpload (Maintained for Security Fixes) This is a fork of the long-abandoned SWFUpload project, maintained by WordPress and others to ensure that a secure version of SWFUpload exists We strongly suggest you do not use SWFUpload But if you must, use this fork WordPress is maintaining a secure version of SWFUpload for use by WordPress plugins that have yet to be updated to u

Filthy! old! blog! bug! blamed! for! Yahoo! webmail! hijacks!

The Register • John Leyden • 01 Feb 2013

Unpatched WordPress flaw clears way for inbox takeovers

Yahoo! webmail accounts are being hijacked by hackers exploiting an eight-month-old bug in the web giant's blog, security biz Bitdefender warns. Messages with a short link to an apparently harmless MSNBC web-page are being spread to compromise mailboxes: the link actually points to a completely different website hosting malicious JavaScript code that swipes the victim's browser cookie used to log into Yahoo! mail. Once this cookie is in the hands of miscreants, they can use it to access the vici...

CVE-2012-3414

Vulnerability Summary

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect