Rich Cannings

Researcher fromGoogle Security Team

#34629of 60,450

8.6Total CVSS

Vulnerabilities · 2

Medium

2

The issue is related to a cross-site scripting (XSS) vulnerability in ActionScript within arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts. This allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the `dataURL` parameter.

The issue allows remote attackers to inject arbitrary web script or HTML via a SWF file that uses the `asfunction:` protocol or the `navigateToURL` function when used with the Flash Player ActiveX Control in Internet Explorer.