CVE-2004-0595
Medium
Description
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Avaya Converged Communications Server
PublishedJul 27, 2004
First seenJul 27, 2004
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya converged_communications_server | 2.0 | — |
| redhat fedora_core | core_1.0, core_2.0 | — |
| trustix secure_linux | 1.5, 2.0, 2.1 | — |
| avaya integrated_management | No range specified | — |
| php php | 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.5, 4.3.6, 4.3.7, 5.0 | — |
| avaya s8300 | r2.0.0, r2.0.1 | — |
| avaya s8500 | r2.0.0, r2.0.1 | — |
| avaya s8700 | r2.0.0, r2.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.