CVE-2000-0081
HighExploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Hotmail does not properly filter JavaScript code from a user's mailbox, allowing a remote attacker to execute the code using hexadecimal codes to specify the javascript: protocol.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code in the user's context, potentially leading to data theft or account takeover.
Recommendation
It is recommended to implement additional filters and security measures to protect against the injection of malicious JavaScript code.
Other vulnerabilities in Hotmail
See all- CVE-2000-0085High
Hotmail does not properly filter JavaScript code from a user's mailbox, allowing a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag.
- CVE-1999-0750Medium
Hotmail allows Javascript to be executed via the HTML STYLE tag, allowing remote attackers to execute commands on the user's Hotmail account.
Original NVD description (English source)
Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: protocol, e.g. jAvascript.