CVE-2006-1731: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the…

Unscored severity · published Apr 14, 2006

CVE-2006-1731

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the…

–

CVSS

1.8%

EPSS

On KEV

Description

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 79% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Firefox · Mozilla

through 1.0.7; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +5 more · source: NVD

Mozilla Suite · Mozilla

through 1.7.12; 1.7.6; 1.7.7; 1.7.8; 1.7.10; 1.7.11 · source: NVD