Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

ZeroClipboard before 1.1.4 lets attackers add malicious code to web pages

CVE-2012-6550 · published 13 years ago
Summary

The ZeroClipboard tool used to copy text from a web page can be tricked into inserting harmful script or HTML when it receives certain data from its Flash component. This could let an attacker run unwanted code in a visitor’s browser, potentially stealing information or altering the page’s behavior. Update ZeroClipboard to version 1.1.4 or later, or replace it with a safer alternative, to stop this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian db4o All versions
– zeroclipboard_project zeroclipboard <= 1.0.7
1.0.5
cpe:2.3:a:zeroclipboard_project:zeroclipboard:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different ...
Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
References
Severity
4.3 Medium
Exploitation
5% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Apr 2013
Updated24 Oct 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-6550 · OSV
CVE-2012-6550 · NVD
Track software like this
Free during beta