medium4.3Public exploit code

CVE-2013-6674

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows use…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass2014-01-27 · dos · multiple

Impact

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Affected products

Vendor	Product	Affected versions
Mozilla	Seamonkey	All versions through 2.20 Versions 1.0, 1.0.1, 1.0.2, 1.0.3
Mozilla	Thunderbird	Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5
Mozilla	Thunderbird Esr	Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5

Weakness classification

CWE-79

Public exploit code

Impact

Affected products

Weakness classification

References