CVE-2008-0454

Microsoft Internet Explorer < 3.6.0.244 - XSS

Title source: rule

Description

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

References (13)

[Third Party Advisory] http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html

[Third Party Advisory] http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html

[Various Sources] http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx

[Various Sources] http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html

[Various Sources] http://skype.com/security/skype-sb-2008-001-update1.html

[Various Sources] http://skype.com/security/skype-sb-2008-001.html

[Various Sources] http://www.critical.lt/?opinions/show/1470

[Various Sources] http://www.gnucitizen.org/blog/vulnerabilities-in-skype

[US Government Resource] http://www.kb.cert.org/vuls/id/248184

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/486512/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/27338

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39754

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0194

Scores

EPSS 0.4365

EPSS Percentile 97.5%

Classification

CWE

CWE-79

Status draft

Affected Products (4)

microsoft/internet_explorer

skype_technologies/skype < 3.6.0.244

skype_technologies/skype

skype_technologies/skype

Timeline

Published Jan 25, 2008

Tracked Since Feb 18, 2026