Vulnerability Details CVE-2008-0454
Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.393
EPSS Ranking 97.1%
CVSS Severity
CVSS v2 Score 9.3
References
- http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html
- http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html
- http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx
- http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html
- http://skype.com/security/skype-sb-2008-001-update1.html
- http://skype.com/security/skype-sb-2008-001.html
- http://www.critical.lt/?opinions/show/1470
- http://www.gnucitizen.org/blog/vulnerabilities-in-skype
- http://www.kb.cert.org/vuls/id/248184
- http://www.securityfocus.com/archive/1/486512/100/0/threaded
- http://www.securityfocus.com/bid/27338
- http://www.vupen.com/english/advisories/2008/0194
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39754
- http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html
- http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html
- http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx
- http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html
- http://skype.com/security/skype-sb-2008-001-update1.html
- http://skype.com/security/skype-sb-2008-001.html
- http://www.critical.lt/?opinions/show/1470
- http://www.gnucitizen.org/blog/vulnerabilities-in-skype
- http://www.kb.cert.org/vuls/id/248184
- http://www.securityfocus.com/archive/1/486512/100/0/threaded
- http://www.securityfocus.com/bid/27338
- http://www.vupen.com/english/advisories/2008/0194
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39754
Products affected by CVE-2008-0454
-
cpe:2.3:a:microsoft:internet_explorer:-
-
cpe:2.3:a:microsoft:internet_explorer:10
-
cpe:2.3:a:microsoft:internet_explorer:11
-
cpe:2.3:a:microsoft:internet_explorer:3.0
-
cpe:2.3:a:microsoft:internet_explorer:3.0.1
-
cpe:2.3:a:microsoft:internet_explorer:3.0.2
-
cpe:2.3:a:microsoft:internet_explorer:3.1
-
cpe:2.3:a:microsoft:internet_explorer:3.2
-
cpe:2.3:a:microsoft:internet_explorer:4.0
-
cpe:2.3:a:microsoft:internet_explorer:4.0.1
-
cpe:2.3:a:microsoft:internet_explorer:4.01
-
cpe:2.3:a:microsoft:internet_explorer:4.1
-
cpe:2.3:a:microsoft:internet_explorer:4.40.308
-
cpe:2.3:a:microsoft:internet_explorer:4.40.520
-
cpe:2.3:a:microsoft:internet_explorer:4.5
-
cpe:2.3:a:microsoft:internet_explorer:4.70.1155
-
cpe:2.3:a:microsoft:internet_explorer:4.70.1158
-
cpe:2.3:a:microsoft:internet_explorer:4.70.1215
-
cpe:2.3:a:microsoft:internet_explorer:4.70.1300
-
cpe:2.3:a:microsoft:internet_explorer:4.71.1008.3
-
cpe:2.3:a:microsoft:internet_explorer:4.71.1712.6
-
cpe:2.3:a:microsoft:internet_explorer:4.71.544
-
cpe:2.3:a:microsoft:internet_explorer:4.72.2106.8
-
cpe:2.3:a:microsoft:internet_explorer:4.72.3110.8
-
cpe:2.3:a:microsoft:internet_explorer:4.72.3612.1713
-
cpe:2.3:a:microsoft:internet_explorer:5
-
cpe:2.3:a:microsoft:internet_explorer:5.0
-
cpe:2.3:a:microsoft:internet_explorer:5.0.1
-
cpe:2.3:a:microsoft:internet_explorer:5.00.0518.10
-
cpe:2.3:a:microsoft:internet_explorer:5.00.0910.1309
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2014.0216
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2314.1003
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2516.1900
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2614.3500
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2919.3800
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2919.6307
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2919.800
-
cpe:2.3:a:microsoft:internet_explorer:5.00.2920.0000
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3103.1000
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3105.0106
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3314.2101
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3315.1000
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3502.1000
-
cpe:2.3:a:microsoft:internet_explorer:5.00.3700.1000
-
cpe:2.3:a:microsoft:internet_explorer:5.01
-
cpe:2.3:a:microsoft:internet_explorer:5.1
-
cpe:2.3:a:microsoft:internet_explorer:5.2.3
-
cpe:2.3:a:microsoft:internet_explorer:5.5
-
cpe:2.3:a:microsoft:internet_explorer:5.50.3825.1300
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4030.2400
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4134.0100
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4134.0600
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4308.2900
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4522.1800
-
cpe:2.3:a:microsoft:internet_explorer:5.50.4807.2300
-
cpe:2.3:a:microsoft:internet_explorer:6
-
cpe:2.3:a:microsoft:internet_explorer:6.0
-
cpe:2.3:a:microsoft:internet_explorer:6.0.2600
-
cpe:2.3:a:microsoft:internet_explorer:6.0.2800
-
cpe:2.3:a:microsoft:internet_explorer:6.0.2800.1106
-
cpe:2.3:a:microsoft:internet_explorer:6.0.2900
-
cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180
-
cpe:2.3:a:microsoft:internet_explorer:6.00.2462.0000
-
cpe:2.3:a:microsoft:internet_explorer:6.00.2479.0006
-
cpe:2.3:a:microsoft:internet_explorer:6.00.2600.0000
-
cpe:2.3:a:microsoft:internet_explorer:6.00.2800.1106
-
cpe:2.3:a:microsoft:internet_explorer:6.00.2900.2180
-
cpe:2.3:a:microsoft:internet_explorer:6.00.3663.0000
-
cpe:2.3:a:microsoft:internet_explorer:6.00.3718.0000
-
cpe:2.3:a:microsoft:internet_explorer:6.00.3790.0000
-
cpe:2.3:a:microsoft:internet_explorer:6.00.3790.1830
-
cpe:2.3:a:microsoft:internet_explorer:6.00.3790.3959
-
cpe:2.3:a:microsoft:internet_explorer:7
-
cpe:2.3:a:microsoft:internet_explorer:7.0
-
cpe:2.3:a:microsoft:internet_explorer:7.0.5730
-
cpe:2.3:a:microsoft:internet_explorer:7.0.5730.11
-
cpe:2.3:a:microsoft:internet_explorer:7.00.5730.1100
-
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16386
-
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16441
-
cpe:2.3:a:microsoft:internet_explorer:8
-
cpe:2.3:a:microsoft:internet_explorer:8.0.6001
-
cpe:2.3:a:microsoft:internet_explorer:9
-
cpe:2.3:a:skype_technologies:skype:*
-
cpe:2.3:a:skype_technologies:skype:3.5
-
cpe:2.3:a:skype_technologies:skype:3.6
-
cpe:2.3:o:microsoft:windows:-
-
cpe:2.3:o:microsoft:windows:1.0
-
cpe:2.3:o:microsoft:windows:2.0
-
cpe:2.3:o:microsoft:windows:2000
-
cpe:2.3:o:microsoft:windows:3.0
-
cpe:2.3:o:microsoft:windows:3.1
-
cpe:2.3:o:microsoft:windows:3.11
-
cpe:2.3:o:microsoft:windows:server_2008
-
cpe:2.3:o:microsoft:windows:vista