CVE-2004-1319

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 15, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-13207.5Asante FM2008 running firmware 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorizedCVE-2004-13217.5The configuration backup in Asante FM2008 running firmware 1.06 stores the username and password in cleartext, which could allow remote attaCVE-2004-13227.5Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote CVE-2004-13232.1Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service (kernel crash) via a large siCVE-2004-13242.6The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the Local computer zoneCVE-2004-13255.0The getItemInfoByAtom function in the ActiveX control for Microsoft Windows Media Player 9.0 returns a 0 if the file does not exist and the CVE-2004-13267.2Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.CVE-2004-13277.5Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that coCVE-2004-13287.2Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.CVE-2004-13297.2Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd in AIX 5.1 through 5CVE-2004-13307.2Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.CVE-2004-13312.6The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialo
CVE-2004-1319: Medium severity, CVSS 5.0 | Vulnix