header-logo
Suggest Exploit
vendor:
Mozilla Firefox, SeaMonkey, Thunderbird
by:
5.5
CVSS
MEDIUM
HTML Injection
79
CWE
Product Name: Mozilla Firefox, SeaMonkey, Thunderbird
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE:
CPE: a:mozilla:firefox, cpe:/a:mozilla:seamonkey, cpe:/a:mozilla:thunderbird
Metasploit:
Other Scripts:
Platforms Tested: Windows, Linux, Mac
2010

HTML Injection Vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Mitigation:

Upgrade to the following versions: Firefox 3.6.13, Firefox 3.5.16, SeaMonkey 2.0.11
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/45353/info

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to multiple HTML-injection vulnerabilities.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue is fixed in:

Firefox 3.6.13
Firefox 3.5.16
SeaMonkey 2.0.11

x-mac-farsi exploit: <meta charset="x-mac-farsi">?script ?alert(1)//?/script ?

Navigation

Suggest Exploit

Services By CQR