NVD

Id
59234  
Name
CVE-2006-0496  
Description
Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2016-12-20  
Published
2006-01-31  
Modified Date
2016-10-17  
Seq
2006-0496  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
304497 59234 CVE-2006-0496 http://community.livejournal.com/lj_dev/708069.html  View
304498 59234 CVE-2006-0496 20060128 -moz-binding CSS property: more XSS fun  View
304499 59234 CVE-2006-0496 1015553  View
304500 59234 CVE-2006-0496 1015563  View
304501 59234 CVE-2006-0496 http://www.davidpashley.com/cgi/pyblosxom.cgi/computing/livejournal-mozilla-bug.html  View
304502 59234 CVE-2006-0496 16427  View
304503 59234 CVE-2006-0496 ADV-2006-0403  View
304504 59234 CVE-2006-0496 mozilla-mozbinding-xss(24427)  View
304505 59234 CVE-2006-0496 https://bugzilla.mozilla.org/show_bug.cgi?id=324253  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
57864 JVNDB-2006-000060 Mozilla Firefox におけるクロスドメインスクリプティングの脆弱性 Mozilla Firefox には、Cascading Style Sheets (CSS) のプロパティ "-moz-binding" を使用して指定された URI におけるドメインが適切にチェックされないため、クロスドメインセキュリティモデルが回避されて異なるドメイン上の XBL (Extensible Binding Language) をバインディングしてしまう脆弱性が存在します。 CVE-2006-0496 16598 CVE-2006-0496 59234 4.3 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000060.html 2006-01-19 2007-04-01 View