The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2010-09-09 19:00
Updated : 2024-02-04 17:54
NVD link : CVE-2010-2763
Mitre link : CVE-2010-2763
CVE.ORG link : CVE-2010-2763
JSON object : View
Products Affected
mozilla
- seamonkey
- firefox
- thunderbird
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')