CVE-2004-1381

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/12712Exploit, Patch, Vendor Advisory
http://secunia.com/multiple_browsers_dialog_box_spoofing_test/Vendor Advisory
http://secunia.com/multiple_browsers_form_field_focus_test/Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-05.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17789
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100053
http://secunia.com/advisories/12712Exploit, Patch, Vendor Advisory
http://secunia.com/multiple_browsers_dialog_box_spoofing_test/Vendor Advisory
http://secunia.com/multiple_browsers_form_field_focus_test/Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-05.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17789
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100053

Timeline

Published: Oct 20, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-13822.1The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a di CVE-2004-13837.5Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via CVE-2004-13844.3Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web sc CVE-2004-13855.0phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID su CVE-2004-13867.5TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scr CVE-2004-13872.1The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on t CVE-2004-13887.5Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attack CVE-2004-13896.0Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCente CVE-2004-139010.0Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument t CVE-2004-13914.6Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modif CVE-2004-13925.0PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to CVE-2004-13935.0Unknown vulnerability in the tcsetattr function for Sun Solaris for SPARC 2.6, 7, and 8 allows local users to cause a denial of service (sys