{"api_version":"1","generated_at":"2026-07-23T04:05:33+00:00","cve":"CVE-2012-3351","urls":{"html":"https://cve.report/CVE-2012-3351","api":"https://cve.report/api/cve/CVE-2012-3351.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-3351","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-3351"},"summary":{"title":"CVE-2012-3351","description":"Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) logo.link, or (3) aboutlink parameter, or a nested URI scheme name for (4) javascript, (5) asfunction, or (6) vbscript.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-02-20 18:15:00","updated_at":"2020-02-24 22:45:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://www.securityfocus.com/bid/55199/exploit","name":"https://www.securityfocus.com/bid/55199/exploit","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"JW Player 'logo.link' Parameter Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.securityfocus.com/bid/54101/discuss","name":"https://www.securityfocus.com/bid/54101/discuss","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"LongTail JW Player CVE-2012-3351 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/37552","name":"https://www.exploit-db.com/exploits/37552","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"JW Player - 'playerready' Cross-Site Scripting - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/37672","name":"https://www.exploit-db.com/exploits/37672","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"JW Player - 'logo.link' Cross-Site Scripting - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://developer.longtailvideo.com/trac/ticket/1585","name":"http://developer.longtailvideo.com/trac/ticket/1585","refsource":"MISC","tags":["Vendor Advisory"],"title":"#1585 (Address cross-site scripting vulnerabilities)\n     – JW Player","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://technet.microsoft.com/security/msvr/msvr12-009","name":"http://technet.microsoft.com/security/msvr/msvr12-009","refsource":"MISC","tags":["Third Party Advisory"],"title":"Microsoft Vulnerability Research Advisory MSVR12-009 | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.securityfocus.com/bid/54101","name":"BID:54101","refsource":"MITRE","tags":[],"title":"LongTail JW Player CVE-2012-3351 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.securityfocus.com/bid/55199","name":"BID:55199","refsource":"MITRE","tags":[],"title":"JW Player 'logo.link' Parameter Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3351","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3351","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"3351","vulnerable":"1","versionEndIncluding":"5.10.2295","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"longtailvideo","cpe5":"jw_player","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-3351","STATE":"PUBLIC"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) logo.link, or (3) aboutlink parameter, or a nested URI scheme name for (4) javascript, (5) asfunction, or (6) vbscript."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"references":{"reference_data":[{"refsource":"MISC","name":"http://developer.longtailvideo.com/trac/ticket/1585","url":"http://developer.longtailvideo.com/trac/ticket/1585"},{"refsource":"MISC","name":"http://technet.microsoft.com/security/msvr/msvr12-009","url":"http://technet.microsoft.com/security/msvr/msvr12-009"},{"refsource":"MISC","name":"https://www.securityfocus.com/bid/54101/discuss","url":"https://www.securityfocus.com/bid/54101/discuss"},{"refsource":"MISC","name":"https://www.securityfocus.com/bid/55199/exploit","url":"https://www.securityfocus.com/bid/55199/exploit"},{"refsource":"MISC","name":"https://www.exploit-db.com/exploits/37552","url":"https://www.exploit-db.com/exploits/37552"},{"refsource":"MISC","name":"https://www.exploit-db.com/exploits/37672","url":"https://www.exploit-db.com/exploits/37672"}]}},"nvd":{"publishedDate":"2020-02-20 18:15:00","lastModifiedDate":"2020-02-24 22:45:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:longtailvideo:jw_player:*:*:*:*:*:*:*:*","versionEndIncluding":"5.10.2295","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"3351","Ordinal":"56098","Title":"CVE-2012-3351","CVE":"CVE-2012-3351","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"3351","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) logo.link, or (3) aboutlink parameter, or a nested URI scheme name for (4) javascript, (5) asfunction, or (6) vbscript.","Type":"Description","Title":null},{"CveYear":"2012","CveId":"3351","Ordinal":"2","NoteData":"2020-02-20","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"3351","Ordinal":"3","NoteData":"2020-02-20","Type":"Other","Title":"Modified"}]}}}