What’s Vulnerable › Vulnerabilities
CVE-2004-1319
- Severity: medium (CVSS 5.0 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 26.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2005-01-06 · updated 2026-06-16
Description
The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.
Affected products
- Microsoft Windows 2000: all versions
- Microsoft Windows 2003 Server: enterprise, enterprise_64-bit, r2, standard, web
- Microsoft Windows 98: all versions
- Microsoft Windows 98Se: all versions
- Microsoft Windows Me: all versions
- Microsoft Windows XP Service Pack 3: all versions
- Nortel Ip Softphone 2050: all versions
- Nortel Mobile Voice Client 2050: all versions
- Nortel Optivity Telephony Manager: all versions
References
- http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html
- http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm
- http://secunia.com/advisories/13482/
- http://www.kb.cert.org/vuls/id/356600
- http://www.securityfocus.com/bid/11950
- http://www.us-cert.gov/cas/techalerts/TA05-039A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18504
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1114
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1701
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3464
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3851
Get alerted when CVE-2004-1319 or the next vulnerability affects your stack