Published: 25/03/2010 Updated: 19/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mozilla Firefox 3.6 prior to 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote malicious users to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.6

Mozilla Foundation Security Advisory 2010-10 XSS via plugins and unprotected Location object Announced March 23, 2010 Reporter Blake Kaplan Impact High Products Firefox Fixed in Fi ...

CWE-79 https://bugzilla.mozilla.org/show_bug.cgi?id=541530 http://www.mozilla.org/security/announce/2010/mfsa2010-10.html http://www.securityfocus.com/bid/38918 http://www.securityfocus.com/bid/38919 http://www.vupen.com/english/advisories/2010/0692 http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602 https://nvd.nist.gov https://www.mozilla.org/en-US/security/advisories/mfsa2010-10/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2010-0170

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect