Description

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

Remediation

References

CVE-2012-2399

Related Vulnerabilities

WordPress Plugin Best Image Gallery & Responsive Photo Gallery-FooGallery Cross-Site Scripting (1.8.14)

Oracle Database Server CVE-2015-4921 Vulnerability (CVE-2015-4921)

Atlassian Jira Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-6531)

Oracle Application Server CVE-2009-0989 Vulnerability (CVE-2009-0989)

WordPress Plugin HTML5 Video Player-Best WordPress Video Player and Block SQL Injection (2.5.26)

Severity

Critical

Classification

CVE-2012-2399

Tags

Missing Update Known Vulnerabilities