CVE-2004-0595: Avaya Converged Communications Server

Medium severity, CVSS 6.8. EPSS: 45.2% chance of exploitation in the next 30 days.

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

Affected products

• Avaya Converged Communications Server: version 2.0 only
• Avaya Integrated Management: any version
• Avaya s8300: version r2.0.0 only; version r2.0.1 only
• Avaya s8500: version r2.0.0 only; version r2.0.1 only
• Avaya s8700: version r2.0.0 only; version r2.0.1 only
• PHP PHP: version 4.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.0.5 only; …
• Red Hat Fedora Core: version core_1.0 only; version core_2.0 only
• Trustix Secure Linux: version 1.5 only; version 2.0 only; version 2.1 only

Published 2004-07-27. Last modified 2026-06-16.