github - ghsa-vx8f-8jqh-8xqr

GHSA-VX8F-8JQH-8XQR

Vulnerability from github – Published: 2022-05-01 18:30 – Updated: 2022-05-01 18:30

Details

The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM's filtering of "specific tags and attributes" and the lack of Local Machine Zone lockdown. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2007-5124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-09-27T19:17:00Z",
    "severity": "MODERATE"
  },
  "details": "The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM\u0027s filtering of \"specific tags and attributes\" and the lack of Local Machine Zone lockdown.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901.",
  "id": "GHSA-vx8f-8jqh-8xqr",
  "modified": "2022-05-01T18:30:18Z",
  "published": "2022-05-01T18:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5124"
    },
    {
      "type": "WEB",
      "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2007-5124 (GCVE-0-2007-5124)

Vulnerability from cvelistv5 – Published: 2007-09-27 19:00 – Updated: 2024-08-07 15:17

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx	x_refsource_MISC
	http://www.securityfocus.com/archive/1/480647/100…	mailing-listx_refsource_BUGTRAQ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:17:28.336Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx"
          },
          {
            "name": "20070925 RE: CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL\u0027s Instant Messaging software",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-09-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM\u0027s filtering of \"specific tags and attributes\" and the lack of Local Machine Zone lockdown.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx"
        },
        {
          "name": "20070925 RE: CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL\u0027s Instant Messaging software",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-5124",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM\u0027s filtering of \"specific tags and attributes\" and the lack of Local Machine Zone lockdown.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx",
              "refsource": "MISC",
              "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx"
            },
            {
              "name": "20070925 RE: CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL\u0027s Instant Messaging software",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-5124",
    "datePublished": "2007-09-27T19:00:00",
    "dateReserved": "2007-09-27T00:00:00",
    "dateUpdated": "2024-08-07T15:17:28.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-VX8F-8JQH-8XQR

CVE-2007-5124 (GCVE-0-2007-5124)

Tags

Sightings

Nomenclature