Vulnerabilities > CVE-2006-0496 - Unspecified vulnerability in Mozilla Firefox and Mozilla

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
mozilla
exploit available
NVD
Published: 2006-02-01
Updated: 2017-07-20

Summary

Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.

Vulnerable Configurations

Part Description Count
Application
Mozilla
24

Exploit-Db

descriptionMozilla Firefox 1.0/1.5 XBL -MOZ-BINDING Property Cross-Domain Scripting Vulnerability. CVE-2006-0496. Remote exploit for linux platform
idEDB-ID:27150
last seen2016-02-03
modified2006-01-30
published2006-01-30
reporterChris Thomas
sourcehttps://www.exploit-db.com/download/27150/
titleMozilla Firefox 1.0/1.5 XBL - MOZ-BINDING Property Cross-Domain Scripting Vulnerability

References