CVE-2010-0170
published 2010-03-25CVE-2010-0170: Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the…
PriorityP415medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.57%
72.9th percentile
Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.
Affected
174 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.6.22 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | seamonkey | <= 2.1 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f562-g9gh-gpgg: Mozilla Firefox before 3
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2011-2999 [MEDIUM] GHSA-f562-g9gh-gpgg: Mozilla Firefox before 3
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170.
GHSA
GHSA-h768-g6c9-cwmw: Mozilla Firefox 3
ghsa_unreviewed·2022-05-02
CVE-2010-0170 [MEDIUM] CWE-79 GHSA-h768-g6c9-cwmw: Mozilla Firefox 3
Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.
Red Hat
Mozilla: XSS via plugins and shadowed window.location object (MFSA 2011-38)
vendor_redhat·2011-09-28·CVSS 4.3
CVE-2011-2999 [MEDIUM] CWE-79 Mozilla: XSS via plugins and shadowed window.location object (MFSA 2011-38)
Mozilla: XSS via plugins and shadowed window.location object (MFSA 2011-38)
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170.
Package: firefox (Red Hat Enterprise Linux Extended Update Support 5.7) - Affected
Package: thunderbird (Red Hat Enterprise Linux Extended Update Support 5.7) - Affected
Package: firefox (Red Hat Enterprise Linux Extended Update Support 6.1) - Affected
Package: thunderbird (Red Hat Enterprise Linux Extended Update Support 6.1) - Affected
No detection rules found.
No public exploits indexed.
http://www.mandriva.com/security/advisories?name=MDVSA-2010:070http://www.mozilla.org/security/announce/2010/mfsa2010-10.htmlhttp://www.securityfocus.com/bid/38918http://www.securityfocus.com/bid/38919http://www.vupen.com/english/advisories/2010/0692https://bugzilla.mozilla.org/show_bug.cgi?id=541530https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602http://www.mandriva.com/security/advisories?name=MDVSA-2010:070http://www.mozilla.org/security/announce/2010/mfsa2010-10.htmlhttp://www.securityfocus.com/bid/38918http://www.securityfocus.com/bid/38919http://www.vupen.com/english/advisories/2010/0692https://bugzilla.mozilla.org/show_bug.cgi?id=541530https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602
2010-03-25
Published