NVD

Id
30131  
Name
CVE-2014-1504  
Description
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-03-19  
Modified Date
2016-12-21  
Seq
2014-1504  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
158811 30131 CVE-2014-1504 SUSE-SU-2014:0418  View
158812 30131 CVE-2014-1504 openSUSE-SU-2014:0419  View
158813 30131 CVE-2014-1504 openSUSE-SU-2014:0448  View
158814 30131 CVE-2014-1504 openSUSE-SU-2014:0584  View
158815 30131 CVE-2014-1504 http://www.mozilla.org/security/announce/2014/mfsa2014-23.html  View
158816 30131 CVE-2014-1504 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
158817 30131 CVE-2014-1504 https://bugzilla.mozilla.org/show_bug.cgi?id=911547  View
158818 30131 CVE-2014-1504 GLSA-201504-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12865 JVNDB-2014-001740 Mozilla Firefox および SeaMonkey のセッション復元機能におけるクロスサイトスクリプティングの脆弱性 Mozilla Firefox および SeaMonkey のセッション復元機能は、data: URL の Content Security Policy (CSP) を配慮しないため、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2014-1504 68791 CVE-2014-1504 30131 2.6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001740.html 2014-03-18 2014-03-20 View