CVE-2008-0454

Microsoft Internet Explorer < 3.6.0.244 - XSS

Title source: rule
STIX 2.1

Description

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

References (13)

Core 13
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/39754
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html
Various Sources x_refsource_misc
http://www.critical.lt/?opinions/show/1470
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/486512/100/0/threaded
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/27338
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/248184
Various Sources x_refsource_confirm
http://skype.com/security/skype-sb-2008-001-update1.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0194
Various Sources x_refsource_confirm
http://skype.com/security/skype-sb-2008-001.html

Scores

EPSS 0.2520
EPSS Percentile 97.7%

Details

CWE
CWE-79
Status published
Products (4)
microsoft/internet_explorer
skype_technologies/skype 3.5
skype_technologies/skype 3.6
skype_technologies/skype < 3.6.0.244
Published Jan 25, 2008
Tracked Since Feb 18, 2026