3429 matches found
Design/Logic Flaw
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...
Privilege escalation
The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with t...
CVE-2017-5453
CVE-2017-5453 affects Mozilla Firefox
CVE-2017-7848
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...
CVE-2017-5391
Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox 51...
CVE-2017-7846
CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...
CVE-2017-7847
Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...
CVE-2017-7847
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...
CVE-2017-5382
Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...
CVE-2017-7846
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View - Feed article - Website" or in the standard format of "View - Feed article - default format". This vulnerability affects Thunderbird 52.5.2...
CVE-2017-7848
CVE-2017-7848 affects Mozilla Thunderbird prior to 52.5.2. The issue allows RSS fields to inject new lines into the created email structure, altering the message body. Public entries and advisories confirm Thunderbird upgrades to 52.5.2 as the fix (e.g., CentOS/RHSA-2018:0061, Debian DSA-4075-1 a...
CVE-2017-5382
CVE-2017-5382 affects Mozilla Firefox prior to 51.0. The feed preview for RSS feeds can expose internal errors/exceptions generated by privileged content, potentially revealing sensitive information. Rationale: described in the CVE entry and corroborated by multiple advisories (OpenSUSE/Mageia/Ub...
CVE-2017-5391
The CVE-2017-5391 entry affects Firefox < 51, where content-injection in about: pages can cause privileged about: pages to load in an iframe, potentially leading to privilege escalation. The issue is described in Mozilla mfsa2017-01 and is referenced in multiple advisories (e.g., openSUSE open...
CVE-2017-5391
Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. This vulnerability affects Firefox 51...
CVE-2017-5453
A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...
CVE-2017-5382
Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...
CVE-2018-5172
The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with t...
CVE-2017-7846
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View - Feed article - Website" or in the standard format of "View - Feed article - default format". This vulnerability affects Thunderbird 52.5.2...