Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Mozilla Thunderbird — RHSA-2018:0061 Clear all filters
TI-2017-05464 CVE-2017-7848 · GHSA-fpgh-654r-2xjr

Injection in Mozilla Thunderbird

Priority LOW 28

RSS fields can inject new lines into the created email structure, modifying the message body.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01728 Published 2018-06-11 Fixed in 52.5.2 CWE-74
TI-2017-05463 CVE-2017-7847 · GHSA-jmgx-hhrr-ppmv

Information disclosure in Mozilla Thunderbird

Priority LOW 23

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01594 Published 2018-06-11 Fixed in 52.5.2 CWE-200
TI-2017-05462 CVE-2017-7846 · GHSA-2529-rwp4-75f6

Injection in Mozilla Thunderbird

Priority MEDIUM 42

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01943 Published 2018-06-11 Fixed in 52.5.2 CWE-74
TI-2017-05446 CVE-2017-7829 · GHSA-hpvr-62fv-x7x4

Improper input validation in Mozilla Thunderbird

Priority LOW 28

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01765 Published 2018-06-11 Fixed in 52.5.2 CWE-20