Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2012-4195 | First vendor Publication | 2012-10-29 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4195 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:16856 | |||
| Oval ID: | oval:org.mitre.oval:def:16856 | ||
| Title: | The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. | ||
| Description: | The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-4195 | Version: | 22 |
| Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Mozilla Firefox Mozilla Thunderbird Mozilla SeaMonkey Mozilla Firefox ESR Mozilla Thunderbird ESR |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-12-13 | Name : SuSE Update for Mozilla Suite openSUSE-SU-2012:1412-1 (Mozilla Suite) File : nvt/gb_suse_2012_1412_1.nasl |
| 2012-11-02 | Name : CentOS Update for thunderbird CESA-2012:1413 centos5 File : nvt/gb_CESA-2012_1413_thunderbird_centos5.nasl |
| 2012-11-02 | Name : CentOS Update for thunderbird CESA-2012:1413 centos6 File : nvt/gb_CESA-2012_1413_thunderbird_centos6.nasl |
| 2012-11-02 | Name : RedHat Update for thunderbird RHSA-2012:1413-01 File : nvt/gb_RHSA-2012_1413-01_thunderbird.nasl |
| 2012-11-02 | Name : Mozilla Firefox Multiple Vulnerabilities - November12 (Mac OS X) File : nvt/gb_mozilla_prdts_mult_vuln_nov12_macosx.nasl |
| 2012-11-02 | Name : Mozilla Firefox Multiple Vulnerabilities - November12 (Windows) File : nvt/gb_mozilla_prdts_mult_vuln_nov12_win.nasl |
| 2012-10-31 | Name : Ubuntu Update for thunderbird USN-1620-2 File : nvt/gb_ubuntu_USN_1620_2.nasl |
| 2012-10-29 | Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox71.nasl |
| 2012-10-29 | Name : CentOS Update for firefox CESA-2012:1407 centos5 File : nvt/gb_CESA-2012_1407_firefox_centos5.nasl |
| 2012-10-29 | Name : CentOS Update for firefox CESA-2012:1407 centos6 File : nvt/gb_CESA-2012_1407_firefox_centos6.nasl |
| 2012-10-29 | Name : RedHat Update for firefox RHSA-2012:1407-01 File : nvt/gb_RHSA-2012_1407-01_firefox.nasl |
| 2012-10-29 | Name : Ubuntu Update for firefox USN-1620-1 File : nvt/gb_ubuntu_USN_1620_1.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-745.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2012-1413.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1407.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox-201210b-121029.nasl - Type : ACT_GATHER_INFO |
| 2013-01-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO |
| 2012-11-01 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_firefox-201210b-8348.nasl - Type : ACT_GATHER_INFO |
| 2012-10-31 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2012-1413.nasl - Type : ACT_GATHER_INFO |
| 2012-10-31 | Name : The remote Scientific Linux host is missing a security update. File : sl_20121029_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-10-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1413.nasl - Type : ACT_GATHER_INFO |
| 2012-10-30 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1620-2.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_10010.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_1602.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Windows host contains a mail client that is potentially affected b... File : mozilla_thunderbird_10010.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Windows host contains a mail client that is potentially affected b... File : mozilla_thunderbird_1602.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Mac OS X host contains a mail client that is potentially affected ... File : macosx_thunderbird_16_0_2.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Mac OS X host contains a mail client that is potentially affected ... File : macosx_thunderbird_10_0_10.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1407.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : seamonkey_2132.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_16_0_2.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_10_0_10.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_6b3b1b97207c11e2a03fc8600054b392.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1620-1.nasl - Type : ACT_GATHER_INFO |
| 2012-10-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1407.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2025-02-07 01:22:00 |
|
| 2024-11-28 22:59:14 |
|
| 2024-11-28 12:31:21 |
|
| 2024-11-01 01:20:48 |
|
| 2024-10-22 09:28:28 |
|
| 2024-10-21 17:28:35 |
|
| 2024-08-02 12:20:59 |
|
| 2024-08-02 01:06:09 |
|
| 2024-02-10 01:18:47 |
|
| 2024-02-02 01:20:21 |
|
| 2024-02-01 12:06:00 |
|
| 2023-09-05 12:19:14 |
|
| 2023-09-05 01:05:53 |
|
| 2023-09-02 12:19:15 |
|
| 2023-09-02 01:05:59 |
|
| 2023-08-12 12:23:08 |
|
| 2023-08-12 01:05:59 |
|
| 2023-08-11 12:19:22 |
|
| 2023-08-11 01:06:10 |
|
| 2023-08-06 12:18:37 |
|
| 2023-08-06 01:06:00 |
|
| 2023-08-04 12:18:41 |
|
| 2023-08-04 01:06:03 |
|
| 2023-07-14 12:18:40 |
|
| 2023-07-14 01:05:57 |
|
| 2023-04-01 01:15:37 |
|
| 2023-03-29 01:20:39 |
|
| 2023-03-28 12:06:05 |
|
| 2022-10-11 12:16:41 |
|
| 2022-10-11 01:05:40 |
|
| 2022-04-26 01:13:46 |
|
| 2021-05-04 12:23:05 |
|
| 2021-04-22 01:27:33 |
|
| 2020-10-14 01:08:17 |
|
| 2020-10-03 01:08:20 |
|
| 2020-08-12 21:23:06 |
|
| 2020-05-29 01:07:40 |
|
| 2020-05-23 01:49:35 |
|
| 2020-05-23 00:34:33 |
|
| 2019-06-25 12:04:45 |
|
| 2019-02-01 12:02:45 |
|
| 2019-01-30 12:04:52 |
|
| 2018-06-29 12:01:16 |
|
| 2018-01-18 12:04:54 |
|
| 2017-11-22 12:04:52 |
|
| 2017-11-21 12:04:04 |
|
| 2017-09-19 09:25:29 |
|
| 2016-06-28 22:02:25 |
|
| 2016-04-26 22:11:57 |
|
| 2014-06-14 13:33:29 |
|
| 2014-02-17 11:12:55 |
|
| 2013-11-04 21:23:46 |
|
| 2013-10-24 13:22:05 |
|
| 2013-05-10 22:44:56 |
|
| 2013-04-11 13:20:47 |
|
| 2013-02-02 13:23:18 |
|
| 2013-01-30 13:23:23 |
|
| 2012-12-06 13:20:18 |
|
| 2012-11-07 13:19:26 |
|
