NVD

Id
12730  
Name
CVE-2010-1197  
Description
Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2010-06-24  
Modified Date
2012-11-05  
Seq
2010-1197  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
70023 12730 CVE-2010-1197 FEDORA-2010-10344  View
70024 12730 CVE-2010-1197 FEDORA-2010-10361  View
70025 12730 CVE-2010-1197 SUSE-SA:2010:030  View
70026 12730 CVE-2010-1197 oval:org.mitre.oval:def:10168  View
70027 12730 CVE-2010-1197 oval:org.mitre.oval:def:14186  View
70028 12730 CVE-2010-1197 http://support.avaya.com/css/P8/documents/100091069  View
70029 12730 CVE-2010-1197 USN-930-1  View
70030 12730 CVE-2010-1197 MDVSA-2010:125  View
70031 12730 CVE-2010-1197 http://www.mozilla.org/security/announce/2010/mfsa2010-32.html  View
70032 12730 CVE-2010-1197 RHSA-2010:0499  View
70033 12730 CVE-2010-1197 RHSA-2010:0500  View
70034 12730 CVE-2010-1197 RHSA-2010:0501  View
70035 12730 CVE-2010-1197 41050  View
70036 12730 CVE-2010-1197 41103  View
70037 12730 CVE-2010-1197 1024138  View
70038 12730 CVE-2010-1197 USN-930-2  View
70039 12730 CVE-2010-1197 ADV-2010-1551  View
70040 12730 CVE-2010-1197 ADV-2010-1556  View
70041 12730 CVE-2010-1197 ADV-2010-1557  View
70042 12730 CVE-2010-1197 ADV-2010-1592  View
70043 12730 CVE-2010-1197 ADV-2010-1640  View
70044 12730 CVE-2010-1197 ADV-2010-1773  View
70045 12730 CVE-2010-1197 firefox-contentdisposition-security-bypass(59667)  View
70046 12730 CVE-2010-1197 https://bugzilla.mozilla.org/show_bug.cgi?id=537120  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35915 JVNDB-2010-001695 複数の Mozilla 製品におけるクロスサイトスクリプティングの脆弱性 複数の Mozilla 製品には、Content-Type: multipart が指定された際、HTTP ヘッダ内の Content-Disposition: attachment を適切に処理しないため、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2010-1197 43777 CVE-2010-1197 12730 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001695.html 2010-06-22 2011-01-06 View