CVE-2004-1319: Microsoft Windows 2000

Medium severity, CVSS 5.0. EPSS: 26.9% chance of exploitation in the next 30 days.

The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: version enterprise only; version enterprise_64-bit only; version r2 only; version standard only; version web only
• Microsoft Windows 98: any version
• Microsoft Windows 98se: any version
• Microsoft Windows Me: any version
• Microsoft Windows XP: any version
• Nortel IP Softphone 2050: any version
• Nortel Mobile Voice Client 2050: any version
• Nortel Optivity Telephony Manager: any version

Published 2004-12-15. Last modified 2026-06-16.