CVSS: 4.3EPSS: 0%CPEs: 69EXPL: 0CVE-2013-2022
https://notcve.org/view.php?id=CVE-2013-2022
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter. NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en el archivo actionscript/Jplayer.as en el componente Flash SWF (jplayer.swf) en jPlayer anterior a versión 2.2.23, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro (1) jQuery o (2 ) id, una vulnerabilidad diferente de CVE-2013-1942 y CVE-2013-2023, como es demostrado mediante el uso de la función alert en el parámetro jQuery. NOTA: estos son los mismos parámetros del CVE-2013-1942, pero la solución para CVE-2013-1942 usa una lista negra para el parámetro jQuery. • http://marc.info/?l=oss-security&m=136570964825921&w=2 http://marc.info/?l=oss-security&m=136726705917858&w=2 http://marc.info/?l=oss-security&m=136773622321563&w=2 http://seclists.org/fulldisclosure/2013/Apr/192 http://www.jplayer.org/2.3.0/release-notes http://www.openwall.com/lists/oss-security/2013/06/27/7 http://www.openwall.com/lists/oss-security/2013/07/04/5 https://github.com/happyworm/jPlayer/commit/c5fe17bb4459164bd59153b57248cf94b8867373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 80EXPL: 0CVE-2013-2023
https://notcve.org/view.php?id=CVE-2013-2023
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo actionscript/Jplayer.as en el componente Flash SWF (jplayer.swf) en jPlayer anterior a versión 2.3.1, permite a atacantes remotos inyectar script web o HTML por medio de vectores no especificados, posiblemente relacionados con listas negras incompletas, una vulnerabilidad diferente de CVE-2013-1942 y CVE-2013-2022. • http://marc.info/?l=oss-security&m=136570964825921&w=2 http://marc.info/?l=oss-security&m=136726705917858&w=2 http://marc.info/?l=oss-security&m=136773622321563&w=2 http://seclists.org/fulldisclosure/2013/Apr/192 http://www.jplayer.org/latest/release-notes http://www.openwall.com/lists/oss-security/2013/06/27/7 http://www.openwall.com/lists/oss-security/2013/07/04/5 https://github.com/happyworm/jPlayer/commit/8ccc429598d62eebe9f65a0a4e6fd406a123c8b4 https://github.com& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 112EXPL: 2CVE-2013-1942 – jPlayer - 'Jplayer.swf' Script Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-1942
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023. Múltiples vulnerabilidades de XSS en actionscript/Jplayer.as en el componente Flash SWF (jplayer.swf) en jPlayer en versiones anteriores a 2.2.20, como se utiliza en ownCloud Server en versiones anteriores a 5.0.4 y otros productos, permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los parámetros (1) jQuery o (2) id, como se demuestra usando document.write en el parámetro jQuery, una vulnerabilidad diferente a CVE-2013-2022 y CVE-2013-2023. • https://www.exploit-db.com/exploits/38460 http://marc.info/?l=oss-security&m=136570964825921&w=2 http://marc.info/?l=oss-security&m=136726705917858&w=2 http://marc.info/?l=oss-security&m=136773622321563&w=2 http://owncloud.org/about/security/advisories/oC-SA-2013-014 http://seclists.org/fulldisclosure/2013/Apr/192 http://www.jplayer.org/2.3.0/release-notes http://www.securityfocus.com/bid/59030 https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •