FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-1464

This CVE name corresponds to:

Entered	Topic
2013-08-05	typo3 -- Multiple vulnerabilities in TYPO3 Core

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-1464 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-1464
Phase	Assigned(20130129)

Description

Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.

References

Source	Reference
MISC	http://insight-labs.org/?p=738
MISC	http://wordpress.org/extend/plugins/audio-player/changelog/
MISC	http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html
SECUNIA	52083
SECUNIA	58854