CVE-2012-2904

player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple "javascript:" sequences in the debug parameter.

• CWE-79

• http://developer.longtailvideo.com/trac/ticket/1585Exploit
• http://seclists.org/fulldisclosure/2012/May/132Exploit
• http://secunia.com/advisories/49130Vendor Advisory
• http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionalityExploit
• http://www.securityfocus.com/bid/53554Exploit
• http://www.wooyun.org/bugs/wooyun-2010-07166Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75672
• http://developer.longtailvideo.com/trac/ticket/1585Exploit
• http://seclists.org/fulldisclosure/2012/May/132Exploit
• http://secunia.com/advisories/49130Vendor Advisory
• http://www.longtailvideo.com/support/forums/jw-player/bug-reports/26699/xss-exists-in-debug-functionalityExploit
• http://www.securityfocus.com/bid/53554Exploit
• http://www.wooyun.org/bugs/wooyun-2010-07166Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75672

Published

May 21, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-2898Google Chrome before 21.0.1180.82 on iOS on iPad devices all…
• CVE-2012-2899Google Chrome before 21.0.1180.82 on iOS makes certain incor…
• CVE-2012-2900Skia, as used in Google Chrome before 22.0.1229.92, does not…
• CVE-2012-2901Cross-site scripting (XSS) vulnerability in the Profile List…
• CVE-2012-2902Unrestricted file upload vulnerability in editor/extensions/…
• CVE-2012-2903Multiple cross-site scripting (XSS) vulnerabilities in PHP A…
• CVE-2012-2905Artiphp CMS 5.5.0 Neo (r422) stores database backups with pr…
• CVE-2012-2906Multiple cross-site scripting (XSS) vulnerabilities in artpu…
• CVE-2012-2907Cross-site scripting (XSS) vulnerability in the aberdeen_bre…
• CVE-2012-2908Multiple SQL injection vulnerabilities in admin/bbcodes.php …
• CVE-2012-2909Multiple cross-site scripting (XSS) vulnerabilities in Visca…
• CVE-2012-2910Multiple cross-site scripting (XSS) vulnerabilities in SiliS…