CVEvulnerability

CVE-2006-1741

4.3 MEDIUM Published 2006-04-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-04-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".

Affected configurations

• mozilla firefox (>= 1.0 < 1.0.8) • mozilla firefox 1.5 • mozilla mozilla suite (< 1.7.13) • mozilla seamonkey (< 1.0) • canonical ubuntu linux 4.10 • canonical ubuntu linux 5.04 • canonical ubuntu linux 5.10

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References