CVE-2004-0841: Avaya Definity One Media Server

Medium severity, CVSS 5.0. EPSS: 48.7% chance of exploitation in the next 30 days.

Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."

Affected products

• Avaya Definity One Media Server: any version
• Avaya IP600 Media Servers: any version
• Avaya Modular Messaging Message Storage Server: version 1.1 only; version 2.0 only
• Avaya s3400: any version
• Avaya s8100: any version
• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 5.0.1 only; version 5.5 only; version 6.0 only

Published 2004-12-23. Last modified 2026-06-16.