Security Advisory

CVE-2013-2204

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2013-07-08 20:00:00

Last updated 2024-08-06 15:27:41

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.

← Browse all CVEs View on cve.org ↗