CVE-2012-2904

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-05-21 · updated 2026-06-16
Weakness: CWE-79

Description

player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple "javascript:" sequences in the debug parameter.

Affected products

Longtailvideo Jw Player: 5.9

References

http://developer.longtailvideo.com/trac/ticket/1585
http://seclists.org/fulldisclosure/2012/May/132
http://secunia.com/advisories/49130
http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionality
http://www.securityfocus.com/bid/53554
http://www.wooyun.org/bugs/wooyun-2010-07166
https://exchange.xforce.ibmcloud.com/vulnerabilities/75672
http://developer.longtailvideo.com/trac/ticket/1585
http://seclists.org/fulldisclosure/2012/May/132
http://secunia.com/advisories/49130
http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionality
http://www.securityfocus.com/bid/53554

Get alerted when CVE-2012-2904 or the next vulnerability affects your stack