Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2015-4490
HistoryAug 16, 2015 - 1:59 a.m.

CVE-2015-4490

2015-08-1601:59:18
CWE-79
[email protected]
web.nvd.nist.gov
51
firefox
cve-2015-4490
xss
csp
security vulnerability
nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.8%

JSON

The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.

Affected configurations

NVD
Node
mozillafirefoxRange≤39.0.3
Node
canonicalubuntu_linuxMatch12.04lts
OR
canonicalubuntu_linuxMatch14.04lts
OR
canonicalubuntu_linuxMatch15.04
OR
opensuseopensuseMatch13.1
OR
opensuseopensuseMatch13.2
Node
oraclesolarisMatch11.3
CPENameOperatorVersion
mozilla:firefoxmozilla firefoxle39.0.3

Related

ubuntucve 1
prion 1
cvelist 1
openvas 7
nvd 1
mozilla 1
nessus 10
ubuntu 3
archlinux 1
freebsd 1
suse 2
kaspersky 1
ibm 1
mageia 1
securityvulns 1
gentoo 1
ubuntucve
ubuntucve
CVE-2015-4490
2015-08-11 00:00:00
prion
prion
Cross site scripting
2015-08-16 01:59:00
cvelist
cvelist
CVE-2015-4490
2015-08-16 01:00:00
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2015-91) - Linux
2021-11-11 00:00:00
Ubuntu: Security Advisory (USN-2702-1)
2015-08-12 00:00:00
Mozilla Firefox Multiple Vulnerabilities (Aug 2015) - Mac OS X
2015-08-19 00:00:00
nvd
nvd
CVE-2015-4490
2015-08-16 01:59:18
mozilla
mozilla
Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification — Mozilla
2015-08-11 00:00:00
nessus
nessus
Ubuntu 14.04 LTS : Ubufox update (USN-2702-2)
2015-08-12 00:00:00
Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2702-1)
2015-08-12 00:00:00
Ubuntu 14.04 LTS : Firefox regression (USN-2702-3)
2015-08-21 00:00:00
ubuntu
ubuntu
Ubufox update
2015-08-11 00:00:00
Firefox regression
2015-08-20 00:00:00
Firefox vulnerabilities
2015-08-11 00:00:00
archlinux
archlinux
firefox: multiple issues
2015-08-12 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2015-08-11 00:00:00
suse
suse
Security update for MozillaFirefox (important)
2015-08-14 19:09:37
Security update for MozillaFirefox (important)
2015-08-14 19:10:03
kaspersky
kaspersky
KLA10643 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
2015-08-11 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Firefox affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance
2018-06-17 22:30:13
mageia
mageia
Updated iceape/sqlite3 packages fix security vulnerabilities
2015-10-27 12:06:52
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey / Firefox OS multiple security vulnerabilities
2015-08-31 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2016-05-31 00:00:00

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.8%

JSON
Related for CVE-2015-4490
ubuntucve1prion1cvelist1openvas7nvd1mozilla1nessus10ubuntu3archlinux1freebsd1suse2kaspersky1ibm1mageia1securityvulns1gentoo1