CVE-2013-6674

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/102566
http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.htmlExploit
http://seclists.org/fulldisclosure/2014/Jan/182Exploit
http://www.kb.cert.org/vuls/id/863369Third Party Advisory, US Government Resource
http://www.mozilla.org/security/announce/2014/mfsa2014-14.htmlVendor Advisory
http://www.securitytracker.com/id/1029773
http://www.securitytracker.com/id/1029774
http://www.ubuntu.com/usn/USN-2119-1
https://bugzilla.mozilla.org/show_bug.cgi?id=868267
http://osvdb.org/102566
http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.htmlExploit
http://seclists.org/fulldisclosure/2014/Jan/182Exploit
http://www.kb.cert.org/vuls/id/863369Third Party Advisory, US Government Resource
http://www.mozilla.org/security/announce/2014/mfsa2014-14.htmlVendor Advisory
http://www.securitytracker.com/id/1029773
http://www.securitytracker.com/id/1029774
http://www.ubuntu.com/usn/USN-2119-1
https://bugzilla.mozilla.org/show_bug.cgi?id=868267

Timeline

Published: Feb 17, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-66815.9Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability CVE-2013-66826.4The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 cert CVE-2013-66836.1The IPv6 implementation in Cisco NX-OS does not properly handle neighbor-table adjacencies, which allows remote attackers to cause a denial CVE-2013-66846.8The web framework on Cisco Wireless LAN Controller (WLC) devices does not properly validate configuration parameters, which allows remote au CVE-2013-66856.6The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gai CVE-2013-66866.8The SSL VPN implementation in Cisco IOS 15.3(1)T2 and earlier allows remote authenticated users to cause a denial of service (interface queu CVE-2013-66874.0The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the CVE-2013-66886.3Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager (ELM) component in Cisco Unified Communi CVE-2013-66896.9Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or cre CVE-2013-66904.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Assurance component in Cisco Prime Collaboration allow remot CVE-2013-66916.8The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to cause CVE-2013-66926.3Cisco IOS XE 3.8S(.2) and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated us