ByteOS

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: http://www.securitytracker.com/id?1018360

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securitytracker.com/id?1018351

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Resource:

x_refsource_MISC

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Resource:

vendor-advisory

x_refsource_MANDRIVA

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/35346

Resource:

vdb-entry

x_refsource_XF

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA07-199A.html

Resource:

third-party-advisory

x_refsource_CERT

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.securityfocus.com/bid/24837

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx

Resource:

x_refsource_MISC

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://www.virusbtn.com/news/virus_news/2007/07_11.xml

Resource:

x_refsource_MISC

Hyperlink: http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/

Resource:

x_refsource_MISC

Hyperlink: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565

Resource:

third-party-advisory

x_refsource_IDEFENSE

Hyperlink: http://www.vupen.com/english/advisories/2007/2565

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-40.html

Resource:

x_refsource_CONFIRM

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.vupen.com/english/advisories/2008/0082

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://osvdb.org/38017

Resource:

vdb-entry

x_refsource_OSVDB

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-23.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.kb.cert.org/vuls/id/358017

Resource:

third-party-advisory

x_refsource_CERT-VN

Hyperlink: http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html

Resource:

x_refsource_MISC

Hyperlink: http://www.vupen.com/english/advisories/2007/4272

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://larholm.com/2007/07/10/internet-explorer-0day-exploit/

Resource:

x_refsource_MISC

Hyperlink: http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Resource:

x_refsource_CONFIRM

Hyperlink: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html

Resource:

mailing-list

x_refsource_FULLDISC

Hyperlink: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Resource:

x_refsource_CONFIRM

Resource:

third-party-advisory

x_refsource_SECUNIA

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.securityfocus.com/archive/1/473276/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

Resource:

third-party-advisory

x_refsource_SECUNIA

Resource:

third-party-advisory

x_refsource_SECUNIA

Resource:

third-party-advisory

x_refsource_SECUNIA

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.vupen.com/english/advisories/2007/2473	vdb-entry x_refsource_VUPEN x_transferred
http://www.ubuntu.com/usn/usn-503-1	vendor-advisory x_refsource_UBUNTU x_transferred
http://www.securitytracker.com/id?1018360	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securitytracker.com/id?1018351	vdb-entry x_refsource_SECTRACK x_transferred
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	vendor-advisory x_refsource_HP x_transferred
http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/	x_refsource_MISC x_transferred
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	vendor-advisory x_refsource_HP x_transferred
http://www.mandriva.com/security/advisories?name=MDKSA-2007:152	vendor-advisory x_refsource_MANDRIVA x_transferred
http://secunia.com/advisories/25984	third-party-advisory x_refsource_SECUNIA x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/35346	vdb-entry x_refsource_XF x_transferred
http://www.us-cert.gov/cas/techalerts/TA07-199A.html	third-party-advisory x_refsource_CERT x_transferred
http://secunia.com/advisories/28179	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.securityfocus.com/bid/24837	vdb-entry x_refsource_BID x_transferred
http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx	x_refsource_MISC x_transferred
http://secunia.com/advisories/26216	third-party-advisory x_refsource_SECUNIA x_transferred
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	vendor-advisory x_refsource_HP x_transferred
http://www.virusbtn.com/news/virus_news/2007/07_11.xml	x_refsource_MISC x_transferred
http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/	x_refsource_MISC x_transferred
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565	third-party-advisory x_refsource_IDEFENSE x_transferred
http://www.vupen.com/english/advisories/2007/2565	vdb-entry x_refsource_VUPEN x_transferred
http://www.mozilla.org/security/announce/2007/mfsa2007-40.html	x_refsource_CONFIRM x_transferred
http://secunia.com/advisories/26149	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.vupen.com/english/advisories/2008/0082	vdb-entry x_refsource_VUPEN x_transferred
http://osvdb.org/38017	vdb-entry x_refsource_OSVDB x_transferred
http://www.mozilla.org/security/announce/2007/mfsa2007-23.html	x_refsource_CONFIRM x_transferred
http://www.kb.cert.org/vuls/id/358017	third-party-advisory x_refsource_CERT-VN x_transferred
http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html	x_refsource_MISC x_transferred
http://www.vupen.com/english/advisories/2007/4272	vdb-entry x_refsource_VUPEN x_transferred
http://larholm.com/2007/07/10/internet-explorer-0day-exploit/	x_refsource_MISC x_transferred
http://www.novell.com/linux/security/advisories/2007_49_mozilla.html	vendor-advisory x_refsource_SUSE x_transferred
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	vendor-advisory x_refsource_HP x_transferred
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt	x_refsource_CONFIRM x_transferred
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html	mailing-list x_refsource_FULLDISC x_transferred
http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html	x_refsource_CONFIRM x_transferred
http://secunia.com/advisories/26258	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/28363	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.securityfocus.com/archive/1/473276/100/0/threaded	mailing-list x_refsource_BUGTRAQ x_transferred
http://secunia.com/advisories/26271	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/26204	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/26572	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/26096	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2007/2473

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: http://www.securitytracker.com/id?1018360

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securitytracker.com/id?1018351

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Resource:

vendor-advisory

x_refsource_HP

x_transferred

Hyperlink: http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Resource:

vendor-advisory

x_refsource_HP

x_transferred

Hyperlink: http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Resource:

vendor-advisory

x_refsource_MANDRIVA

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/35346

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA07-199A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.securityfocus.com/bid/24837

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx

Resource:

x_refsource_MISC

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Resource:

vendor-advisory

x_refsource_HP

x_transferred

Hyperlink: http://www.virusbtn.com/news/virus_news/2007/07_11.xml

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565

Resource:

third-party-advisory

x_refsource_IDEFENSE

x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2007/2565

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-40.html

Resource:

x_refsource_CONFIRM

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2008/0082

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Hyperlink: http://osvdb.org/38017

Resource:

vdb-entry

x_refsource_OSVDB

x_transferred

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-23.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.kb.cert.org/vuls/id/358017

Resource:

third-party-advisory

x_refsource_CERT-VN

x_transferred

Hyperlink: http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2007/4272

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Hyperlink: http://larholm.com/2007/07/10/internet-explorer-0day-exploit/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Resource:

vendor-advisory

x_refsource_HP

x_transferred

Hyperlink: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html

Resource:

mailing-list

x_refsource_FULLDISC

x_transferred

Hyperlink: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Resource:

x_refsource_CONFIRM

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.securityfocus.com/archive/1/473276/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:10 Jul, 2007 | 19:30

Updated At:23 Apr, 2026 | 00:35

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

Evaluator Impact

Successful exploit requires that Mozilla Firefox is installed.

References

Hyperlink	Source	Resource
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt	cve@mitre.org	N/A
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html	cve@mitre.org	N/A
http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/	cve@mitre.org	N/A
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	cve@mitre.org	N/A
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	cve@mitre.org	N/A
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565	cve@mitre.org	N/A
http://larholm.com/2007/07/10/internet-explorer-0day-exploit/	cve@mitre.org	N/A
http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx	cve@mitre.org	N/A
http://osvdb.org/38017	cve@mitre.org	N/A
http://secunia.com/advisories/25984	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26096	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26149	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26204	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26216	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26258	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26271	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/26572	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/28179	cve@mitre.org	N/A
http://secunia.com/advisories/28363	cve@mitre.org	N/A
http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html	cve@mitre.org	N/A
http://www.kb.cert.org/vuls/id/358017	cve@mitre.org	US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:152	cve@mitre.org	N/A
http://www.mozilla.org/security/announce/2007/mfsa2007-23.html	cve@mitre.org	N/A
http://www.mozilla.org/security/announce/2007/mfsa2007-40.html	cve@mitre.org	N/A
http://www.novell.com/linux/security/advisories/2007_49_mozilla.html	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/473276/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/bid/24837	cve@mitre.org	N/A
http://www.securitytracker.com/id?1018351	cve@mitre.org	N/A
http://www.securitytracker.com/id?1018360	cve@mitre.org	N/A
http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/	cve@mitre.org	N/A
http://www.ubuntu.com/usn/usn-503-1	cve@mitre.org	N/A
http://www.us-cert.gov/cas/techalerts/TA07-199A.html	cve@mitre.org	US Government Resource
http://www.virusbtn.com/news/virus_news/2007/07_11.xml	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2007/2473	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2007/2565	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2007/4272	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2008/0082	cve@mitre.org	N/A
http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/35346	cve@mitre.org	N/A
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt	af854a3a-2127-422b-91ae-364da2661108	N/A
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/	af854a3a-2127-422b-91ae-364da2661108	N/A
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	af854a3a-2127-422b-91ae-364da2661108	N/A
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	af854a3a-2127-422b-91ae-364da2661108	N/A
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565	af854a3a-2127-422b-91ae-364da2661108	N/A
http://larholm.com/2007/07/10/internet-explorer-0day-exploit/	af854a3a-2127-422b-91ae-364da2661108	N/A
http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx	af854a3a-2127-422b-91ae-364da2661108	N/A
http://osvdb.org/38017	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/25984	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26096	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26149	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26204	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26216	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26258	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26271	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/26572	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/28179	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/28363	af854a3a-2127-422b-91ae-364da2661108	N/A
http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.kb.cert.org/vuls/id/358017	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:152	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.mozilla.org/security/announce/2007/mfsa2007-23.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.mozilla.org/security/announce/2007/mfsa2007-40.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.novell.com/linux/security/advisories/2007_49_mozilla.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/archive/1/473276/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/24837	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id?1018351	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id?1018360	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.ubuntu.com/usn/usn-503-1	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.us-cert.gov/cas/techalerts/TA07-199A.html	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.virusbtn.com/news/virus_news/2007/07_11.xml	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.vupen.com/english/advisories/2007/2473	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.vupen.com/english/advisories/2007/2565	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.vupen.com/english/advisories/2007/4272	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.vupen.com/english/advisories/2008/0082	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/35346	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://larholm.com/2007/07/10/internet-explorer-0day-exploit/

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://osvdb.org/38017

Source: cve@mitre.org

Resource: N/A

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource:

Vendor Advisory

Source: cve@mitre.org

Resource: N/A

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.kb.cert.org/vuls/id/358017

Source: cve@mitre.org

Resource:

US Government Resource

Hyperlink: http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-23.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-40.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/archive/1/473276/100/0/threaded

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/24837

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1018351

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1018360

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/

Source: cve@mitre.org

Resource: N/A

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA07-199A.html

Source: cve@mitre.org

Resource:

US Government Resource

Hyperlink: http://www.virusbtn.com/news/virus_news/2007/07_11.xml

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/2473

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/2565

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/4272

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2008/0082

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/35346

Source: cve@mitre.org

Resource: N/A

Hyperlink: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://larholm.com/2007/07/10/internet-explorer-0day-exploit/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://osvdb.org/38017

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.kb.cert.org/vuls/id/358017

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

US Government Resource

Hyperlink: http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-23.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2007/mfsa2007-40.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/archive/1/473276/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/24837

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1018351

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1018360

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA07-199A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

US Government Resource

Hyperlink: http://www.virusbtn.com/news/virus_news/2007/07_11.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/2473

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/2565

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2007/4272

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.vupen.com/english/advisories/2008/0082

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/35346

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

13188Records found

CVE-2021-40457

Matching Score-10

Matching Score-10

CVSS Score-7.4||HIGH

EPSS-1.54% / 72.39%

7 Day CHG~0.00%

Published-13 Oct, 2021 | 00:26

Updated-04 Aug, 2024 | 02:44

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

Product-dynamics_365 Microsoft Dynamics 365 Customer Engagement V9.1 Microsoft Dynamics 365 Customer Engagement V9.0

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0471

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.05% / 79.22%

7 Day CHG+0.02%

Published-25 Apr, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set.

Product-thunderbird firefox thunderbird_esr seamonkey n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0765

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-2.65% / 84.02%

7 Day CHG~0.00%

Published-15 Feb, 2012 | 01:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to certain .htm files in (1) template_stock and (2) template_csh directories.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows word n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0477

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.05% / 79.22%

7 Day CHG+0.02%

Published-25 Apr, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set.

Product-thunderbird firefox thunderbird_esr seamonkey n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0474

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.91% / 77.69%

7 Day CHG+0.02%

Published-25 Apr, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."

Product-thunderbird firefox thunderbird_esr seamonkey n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-7834

Matching Score-10

Assigner-Mozilla Corporation

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.54% / 72.36%

7 Day CHG~0.00%

Published-11 Jun, 2018 | 21:00

Updated-05 Aug, 2024 | 16:19

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.

Product-firefox Firefox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8551

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-3.26% / 87.08%

7 Day CHG~0.00%

Published-15 Jun, 2017 | 01:00

Updated-13 May, 2026 | 00:24

An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".

Product-project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8642

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.96% / 85.74%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 21:00

Updated-13 May, 2026 | 00:24

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.

Product-windows_10 edge Microsoft Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-7839

Matching Score-10

Assigner-Mozilla Corporation

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.14% / 63.35%

7 Day CHG~0.00%

Published-11 Jun, 2018 | 21:00

Updated-05 Aug, 2024 | 16:19

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

Product-firefox Firefox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0455

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.76% / 75.62%

7 Day CHG-0.02%

Published-14 Mar, 2012 | 19:00

Updated-29 Apr, 2026 | 01:13

Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.

Product-thunderbird firefox firefox_esr seamonkey thunderbird_esr n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-10

Matching Score-10

Vendor-n/a Microsoft Corporation Oracle Corporation Adobe Inc.Apple Inc.Linux Kernel Organization, Inc Google LLC

CVSS Score-6.1||MEDIUM

EPSS-6.66% / 93.18%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-21 Apr, 2026 | 21:13

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Product-mac_os_x solaris windows flash_player android linux_kernel n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-7109

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.97% / 58.21%

7 Day CHG~0.00%

Published-23 Oct, 2017 | 01:00

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-itunes windows iphone_os safari tvos icloud n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5466

Matching Score-10

Assigner-Mozilla Corporation

Product-thunderbird firefox enterprise_linux enterprise_linux_desktop enterprise_linux_server_eus enterprise_linux_server enterprise_linux_workstation enterprise_linux_server_aus Thunderbird Firefox ESR Firefox

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.55% / 72.41%

7 Day CHG~0.00%

Published-11 Jun, 2018 | 21:00

Updated-25 Nov, 2025 | 17:50

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Vendor-Red Hat, Inc.Mozilla Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4726

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.92% / 56.59%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.

Vendor-n/a Red Hat, Inc.Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows enterprise_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0017

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-18.00% / 96.88%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5393

Matching Score-10

Assigner-Mozilla Corporation

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.90% / 55.80%

7 Day CHG~0.00%

Published-11 Jun, 2018 | 21:00

Updated-05 Aug, 2024 | 14:55

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects Firefox < 51.

Product-firefox Firefox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-10

Assigner-HP Inc.

Matching Score-10

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.91% / 77.57%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows business_availability_center n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0145

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-18.00% / 96.88%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in wizardlist.aspx Vulnerability."

Product-sharepoint_foundation sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0144

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-18.00% / 96.88%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in themeweb.aspx Vulnerability."

Product-sharepoint_foundation sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5069

Matching Score-10

Assigner-Chrome

Product-enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 58.0.3029.81 for Linux, Windows and Mac, and 58.0.3029.83 for Android

Matching Score-10

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 64.39%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-13 May, 2026 | 00:24

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4777

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.93% / 56.94%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.

Vendor-n/a Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows_2003_server windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4776

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.92% / 56.59%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.

Vendor-n/a Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows_2003_server windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0007

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-19.28% / 97.05%

7 Day CHG~0.00%

Published-10 Jan, 2012 | 21:00

Updated-29 Apr, 2026 | 01:13

The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability."

Product-anti-cross_site_scripting_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4735

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.30% / 67.52%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.

Vendor-n/a Red Hat, Inc.Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows enterprise_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-35222

Matching Score-10

Assigner-SolarWinds

Matching Score-10

Assigner-SolarWinds

CVSS Score-8||HIGH

EPSS-2.61% / 83.81%

7 Day CHG~0.00%

Published-31 Aug, 2021 | 12:14

Updated-04 Aug, 2024 | 00:33

Resource.aspx Reflected Cross-Site Scripting Vulnerability

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

Vendor-SolarWinds Worldwide, LLC.Microsoft Corporation

Product-windows orion_platform Orion Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29944

Matching Score-10

Assigner-Mozilla Corporation

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.70% / 49.42%

7 Day CHG~0.00%

Published-24 Jun, 2021 | 13:20

Updated-03 Aug, 2024 | 22:18

Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88.

Product-firefox Firefox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29953

Matching Score-10

Assigner-Mozilla Corporation

Matching Score-10

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.65% / 47.22%

7 Day CHG~0.00%

Published-24 Jun, 2021 | 13:17

Updated-03 Aug, 2024 | 22:18

A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.

Product-firefox Firefox Firefox for Android

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3656

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.76% / 51.51%

7 Day CHG~0.00%

Published-02 Jun, 2021 | 16:31

Updated-06 Aug, 2024 | 23:46

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP 0.9 errors, non-default ports, and content-sniffing.

Product-firefox n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3648

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.45% / 70.69%

7 Day CHG~0.00%

Published-09 Nov, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding.

Product-thunderbird firefox n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3657

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.57% / 72.74%

7 Day CHG~0.00%

Published-02 Jan, 2012 | 19:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when debug mode is used, allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report, (2) graphical report, or (3) new chart.

Product-bugzilla n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2444

Matching Score-10

Matching Score-10

Vendor-n/a Apple Inc.Sun Microsystems (Oracle Corporation)Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.70% / 84.37%

7 Day CHG~0.00%

Published-22 Sep, 2011 | 01:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.

Product-mac_os_x sunos windows flash_player android linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2670

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-6.1||MEDIUM

EPSS-0.70% / 49.23%

7 Day CHG~0.00%

Published-13 Jan, 2020 | 13:33

Updated-06 Aug, 2024 | 23:08

Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets

Product-firefox Firefox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-28459

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.32% / 81.64%

7 Day CHG~0.00%

Published-13 Apr, 2021 | 19:33

Updated-03 Aug, 2024 | 21:40

Azure DevOps Server Spoofing Vulnerability

Product-azure_devops_server Azure DevOps Server 2020.0.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2976

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.45% / 70.54%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie.

Product-bugzilla n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2369

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.35% / 68.61%

7 Day CHG~0.00%

Published-30 Jun, 2011 | 16:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.

Product-firefox n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2379

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.67% / 74.36%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Apple Inc.Mozilla Corporation Microsoft Corporation

Product-internet_explorer safari bugzilla n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1894

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-11.41% / 95.55%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-29 Apr, 2026 | 01:13

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted EMBED element in a web page that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Product-windows_7 windows_server_2008 windows_vista windows_xp windows_2003_server windows_server_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0017

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-41.95% / 98.55%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068.

Product-edge Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1897

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-8.40% / 94.40%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1587

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.71% / 74.98%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.

Vendor-n/a Microsoft Corporation Wikimedia Foundation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1765

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.10% / 79.74%

7 Day CHG~0.00%

Published-23 May, 2011 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.

Vendor-n/a Microsoft Corporation Wikimedia Foundation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0110

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.02% / 93.50%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

Product-exchange_server Exchange Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29712

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.65% / 47.47%

7 Day CHG~0.00%

Published-09 Jul, 2021 | 16:55

Updated-16 Sep, 2024 | 16:18

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 200966.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1976

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-20.81% / 97.29%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

Product-report_viewer visual_studio n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0107

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-6.98% / 93.46%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."

Product-sharepoint_foundation SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1893

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-16.77% / 96.71%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability."

Product-sharepoint_foundation sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1263

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-15.24% / 96.41%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."

Product-windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2107

Matching Score-10

Matching Score-10

Vendor-n/a Apple Inc.Sun Microsystems (Oracle Corporation)Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-3.55% / 88.10%

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Product-acrobat acrobat_reader mac_os_x sunos windows flash_player android linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-2260

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.09% / 61.90%

7 Day CHG~0.00%

Published-18 Oct, 2007 | 10:00

Updated-16 Apr, 2026 | 00:27

Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.

Product-bugzilla n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1252

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-13.97% / 96.16%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."