PRIOn knowledge basePRION:CVE-2010-2768Cross site scripting
6 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
68.9%
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document’s charset, which allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms via UTF-7 encoding.
References
blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
secunia.com/advisories/42867
support.avaya.com/css/P8/documents/100110210
support.avaya.com/css/P8/documents/100112690
www.debian.org/security/2010/dsa-2106
www.mandriva.com/security/advisories?name=MDVSA-2010:173
www.mozilla.org/security/announce/2010/mfsa2010-61.html
www.securityfocus.com/bid/43101
www.vupen.com/english/advisories/2010/2323
www.vupen.com/english/advisories/2011/0061
bugzilla.mozilla.org/show_bug.cgi?id=579744
lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11735
Related
6 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
68.9%