4.3

CVE-2007-5960

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version0.8
Mozilla ≫ Firefox Version0.9
Mozilla ≫ Firefox Version0.9.1
Mozilla ≫ Firefox Version0.9.2
Mozilla ≫ Firefox Version0.9.3
Mozilla ≫ Firefox Version0.10
Mozilla ≫ Firefox Version0.10.1
Mozilla ≫ Firefox Version1.0
Mozilla ≫ Firefox Version1.0.1
Mozilla ≫ Firefox Version1.0.2
Mozilla ≫ Firefox Version1.0.3
Mozilla ≫ Firefox Version1.0.4
Mozilla ≫ Firefox Version1.0.5
Mozilla ≫ Firefox Version1.0.6
Mozilla ≫ Firefox Version1.0.7
Mozilla ≫ Firefox Version1.0.8
Mozilla ≫ Firefox Version1.5
Mozilla ≫ Firefox Version1.5.0.1
Mozilla ≫ Firefox Version1.5.0.2
Mozilla ≫ Firefox Version1.5.0.3
Mozilla ≫ Firefox Version1.5.0.4
Mozilla ≫ Firefox Version1.5.0.5
Mozilla ≫ Firefox Version1.5.0.6
Mozilla ≫ Firefox Version1.5.0.7
Mozilla ≫ Firefox Version1.5.0.8
Mozilla ≫ Firefox Version1.5.0.9
Mozilla ≫ Firefox Version1.5.0.10
Mozilla ≫ Firefox Version1.5.0.11
Mozilla ≫ Firefox Version1.5.0.12
Mozilla ≫ Firefox Version1.5.1
Mozilla ≫ Firefox Version1.5.2
Mozilla ≫ Firefox Version1.5.3
Mozilla ≫ Firefox Version1.5.4
Mozilla ≫ Firefox Version1.5.5
Mozilla ≫ Firefox Version1.5.6
Mozilla ≫ Firefox Version1.5.7
Mozilla ≫ Firefox Version1.5.8
Mozilla ≫ Firefox Version1.8
Mozilla ≫ Firefox Version2.0
Mozilla ≫ Firefox Version2.0 Updatebeta1
Mozilla ≫ Firefox Version2.0 Updaterc2
Mozilla ≫ Firefox Version2.0 Updaterc3
Mozilla ≫ Firefox Version2.0.0.1
Mozilla ≫ Firefox Version2.0.0.2
Mozilla ≫ Firefox Version2.0.0.3
Mozilla ≫ Firefox Version2.0.0.4
Mozilla ≫ Firefox Version2.0.0.5
Mozilla ≫ Firefox Version2.0.0.6
Mozilla ≫ Firefox Version2.0.0.7
Mozilla ≫ Firefox Version2.0.0.8
Mozilla ≫ Firefox Version2.0.0.9
Mozilla ≫ Seamonkey Version <= 1.1.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.47% 0.703
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://www.vupen.com/english/advisories/2008/0083
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://secunia.com/advisories/28398
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
http://www.vupen.com/english/advisories/2008/0643
http://browser.netscape.com/releasenotes/
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://bugs.gentoo.org/show_bug.cgi?id=200909
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
http://secunia.com/advisories/27793
Vendor Advisory
http://secunia.com/advisories/27796
Vendor Advisory
http://secunia.com/advisories/27797
Vendor Advisory
http://secunia.com/advisories/27800
Vendor Advisory
http://secunia.com/advisories/27816
Vendor Advisory
http://secunia.com/advisories/27838
Vendor Advisory
http://secunia.com/advisories/27845
Vendor Advisory
http://secunia.com/advisories/27855
Vendor Advisory
http://secunia.com/advisories/27944
Vendor Advisory
http://secunia.com/advisories/27955
Vendor Advisory
http://secunia.com/advisories/27957
Vendor Advisory
http://secunia.com/advisories/27979
Vendor Advisory
http://secunia.com/advisories/28001
Vendor Advisory
http://secunia.com/advisories/28016
Vendor Advisory
http://secunia.com/advisories/28171
Vendor Advisory
http://secunia.com/advisories/28277
Vendor Advisory
http://secunia.com/advisories/29164
http://security.gentoo.org/glsa/glsa-200712-21.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
http://www.debian.org/security/2007/dsa-1424
http://www.debian.org/security/2007/dsa-1425
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
http://www.redhat.com/support/errata/RHSA-2007-1082.html
Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1083.html
Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html
Vendor Advisory
http://www.securityfocus.com/archive/1/488002/100/0/threaded
http://www.securityfocus.com/archive/1/488971/100/0/threaded
http://www.ubuntu.com/usn/usn-546-2
http://www.vupen.com/english/advisories/2007/4002
http://www.vupen.com/english/advisories/2007/4018
https://issues.rpath.com/browse/RPL-1984
https://issues.rpath.com/browse/RPL-1995
https://usn.ubuntu.com/546-1/
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html
http://secunia.com/advisories/27725
Vendor Advisory
http://securitytracker.com/id?1018995
http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.securityfocus.com/bid/26589
https://exchange.xforce.ibmcloud.com/vulnerabilities/38644
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794