Unscored severity · published Dec 31, 2004
CVE-2004-2475
Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section
–
CVSS
3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section. NOTE: some followup posts suggest that the demonstration code's use of the res:// protocol does not cross privilege boundaries, since it is not allowed in the Internet Zone. Thus this might not be a vulnerability.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Toolbar · Google
1.1.41; 1.1.42; 1.1.43; 1.1.44; 1.1.45; 1.1.47; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2475
Exploit
http://archives.neohapsis.com/archives/bugtraq/2004-09/0226.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0629.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0639.html
Exploit
http://securitytracker.com/id?1011351
www.osvdb.org
http://www.osvdb.org/10037
Exploit
http://www.securityfocus.com/bid/11210
More from Toolbar
–
CVE-2007-6536
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without…
–
CVE-2002-1442
The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My…
–
CVE-2002-1443
The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler
–
CVE-2002-1444
The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via…