CVE-2012-2904

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• LongTail JW Player - 'debug' Cross-Site Scripting2012-05-16 · webapps · php · Verified

Impact

player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple "javascript:" sequences in the debug parameter.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://developer.longtailvideo.com/trac/ticket/1585
• http://seclists.org/fulldisclosure/2012/May/132
• http://secunia.com/advisories/49130
• http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionality
• http://www.securityfocus.com/bid/53554
• http://www.wooyun.org/bugs/wooyun-2010-07166
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75672
• http://developer.longtailvideo.com/trac/ticket/1585
• http://seclists.org/fulldisclosure/2012/May/132
• http://secunia.com/advisories/49130
• http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionality
• http://www.securityfocus.com/bid/53554
• http://www.wooyun.org/bugs/wooyun-2010-07166
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75672