Description
Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.
References
- oval:org.mitre.oval:def:15716 vdb-entry signature
- winamp-nowplaying-unspecified(44207) vdb-entry
- http://forums.winamp.com/showthread.php?threadid=295505
- 31371 third-party-advisory
- http://blog.watchfire.com/wfblog/2008/09/winamp-nowplayi.html
- 30539 vdb-entry