Home > Vulnerability Database > CVE-2010-2768

Mend.io Vulnerability Database

CVE-2010-2768

Date: September 9, 2010

Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms via UTF-7 encoding.

Severity Score

3.7

Related Resources (18)

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2010:173

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=579744

Url: http://www.vupen.com/english/advisories/2010/2323

Url: http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html

Url: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox

Url: http://www.vupen.com/english/advisories/2011/0061

Url: http://www.securityfocus.com/bid/43101

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2010-2768

Url: https://nvd.nist.gov/vuln/detail/CVE-2010-2768

Url: https://access.redhat.com/security/cve/CVE-2010-2768

Url: http://support.avaya.com/css/P8/documents/100112690

Url: http://www.mozilla.org/security/announce/2010/mfsa2010-61.html

Url: http://secunia.com/advisories/42867

Url: http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html

Url: http://support.avaya.com/css/P8/documents/100110210

Url: http://www.debian.org/security/2010/dsa-2106

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11735

Url: https://www.mend.io/vulnerability-database/CVE-2010-2768

Severity Score

3.7

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2010-2768

Date: September 9, 2010

Severity Score

Related Resources (18)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?