CVE-2013-6880

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-12/0051.htmlBroken Link
http://www.7elements.co.uk/news/cve-2013-6880Third Party Advisory
http://www.7elements.co.uk/resources/blog/cve-2013-6880-proof-conceptExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89663Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-12/0051.htmlBroken Link
http://www.7elements.co.uk/news/cve-2013-6880Third Party Advisory
http://www.7elements.co.uk/resources/blog/cve-2013-6880-proof-conceptExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89663Third Party Advisory, VDB Entry

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-688110.0CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacte CVE-2013-68824.3Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote CVE-2013-68836.8Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers t CVE-2013-688410.0The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allo CVE-2013-68854.7The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined CVE-2013-68867.2RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) vncserver, (2) vncser CVE-2013-68876.4OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division CVE-2013-68887.5Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.CVE-2013-68894.9GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option.CVE-2013-68905.0denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of se CVE-2013-68911.2lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HO CVE-2013-68923.5WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.