The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 01:17
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html - | |
References | () http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html - | |
References | () http://www.debian.org/security/2010/dsa-2106 - | |
References | () http://www.mozilla.org/security/announce/2010/mfsa2010-60.html - Vendor Advisory | |
References | () http://www.vupen.com/english/advisories/2010/2323 - | |
References | () https://bugzilla.mozilla.org/show_bug.cgi?id=585284 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/61665 - | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12114 - |
Information
Published : 2010-09-09 19:00
Updated : 2024-11-21 01:17
NVD link : CVE-2010-2763
Mitre link : CVE-2010-2763
CVE.ORG link : CVE-2010-2763
JSON object : View
Products Affected
mozilla
- seamonkey
- thunderbird
- firefox
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')