CVE-2010-0170

EPSS 0.5%
Published 25.03.2010 21:00:00
Last modified 11.04.2025 00:51:21
Source cve@mitre.org
Teams watchlist Login
Open Login

Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

Affected products Warnungen 0 Metrics 2 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version3.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.5%	0.631

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.mandriva.com/security/advisories?name=MDVSA-2010:070

http://www.securityfocus.com/bid/38918

http://www.vupen.com/english/advisories/2010/0692

http://www.mozilla.org/security/announce/2010/mfsa2010-10.html

Vendor Advisory

http://www.securityfocus.com/bid/38919

https://bugzilla.mozilla.org/show_bug.cgi?id=541530

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602

https://nvd.nist.gov/vuln/detail/CVE-2010-0170

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2010-0170

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2010-0170

EUVD