Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.davidpashley.com/cgi/pyblosxom.cgi/computing/livejournal-mozilla-bug.html | x_refsource_MISC |
| https://bugzilla.mozilla.org/show_bug.cgi?id=324253 | x_refsource_CONFIRM |
| http://securitytracker.com/id?1015563 | vdb-entry x_refsource_SECTRACK |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24427 | vdb-entry x_refsource_XF |
| http://www.vupen.com/english/advisories/2006/0403 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/bid/16427 | vdb-entry x_refsource_BID |
| http://community.livejournal.com/lj_dev/708069.html | x_refsource_MISC |
| http://securitytracker.com/id?1015553 | vdb-entry x_refsource_SECTRACK |
| http://marc.info/?l=full-disclosure&m=113847912709062&w=2 | mailing-list x_refsource_FULLDISC |
| http://www.osvdb.org/22924 | vdb-entry x_refsource_OSVDB |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.davidpashley.com/cgi/pyblosxom.cgi/computing/livejournal-mozilla-bug.html | x_refsource_MISC x_transferred |
| https://bugzilla.mozilla.org/show_bug.cgi?id=324253 | x_refsource_CONFIRM x_transferred |
| http://securitytracker.com/id?1015563 | vdb-entry x_refsource_SECTRACK x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24427 | vdb-entry x_refsource_XF x_transferred |
| http://www.vupen.com/english/advisories/2006/0403 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/bid/16427 | vdb-entry x_refsource_BID x_transferred |
| http://community.livejournal.com/lj_dev/708069.html | x_refsource_MISC x_transferred |
| http://securitytracker.com/id?1015553 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://marc.info/?l=full-disclosure&m=113847912709062&w=2 | mailing-list x_refsource_FULLDISC x_transferred |
| http://www.osvdb.org/22924 | vdb-entry x_refsource_OSVDB x_transferred |