CVE-2014-1530

MEDIUM

Mozilla Firefox < 29.0 - XSS

Title source: rule

Description

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.

References (23)

... and 3 more

Scores

CVSS v3 6.1
EPSS 0.0086
EPSS Percentile 74.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-79
Status draft

Affected Products (26)

mozilla/firefox < 29.0
mozilla/seamonkey < 2.26
mozilla/thunderbird < 24.5
fedoraproject/fedora
fedoraproject/fedora
canonical/ubuntu_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
debian/debian_linux
debian/debian_linux
redhat/enterprise_linux_desktop
redhat/enterprise_linux_desktop
redhat/enterprise_linux_eus
redhat/enterprise_linux_server
... and 11 more

Timeline

Published Apr 30, 2014
Tracked Since Feb 18, 2026